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IN  THE  UNITED  STATES  DISTRICT  COURT 
FOR  THE  SOUTHERN  DISTRICT  OF  NEW  YORK 


DEMOCRATIC  NATIONAL  COMMITTEE, 
Plaintiff, 
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DONALD  J.  TRUMP  FOR  PRESIDENT,  INC.; 
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PAUL  J.  MANAFORT,  JR.; 

ROGER  J.  STONE,  JR.; 

JARED  C.  KUSHNER; 
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RICHARD  W.  GATES,  III; 
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Plaintiff  the  Democratic  National  Committee  (“DNC”)  brings  this  Complaint  against  The 
Russian  Federation  (“Russia”);  the  General  Staff  of  the  Armed  Forces  of  the  Russian  Federation 
(“GRU”);  Aras  Iskenerovich  Agalarov  (“Aras  Agalarov”);  Emin  Araz  Agalarov  (“Emin 
Agalarov”);  Joseph  Mifsud  (“Mifsud”);  WikiLeaks;  Julian  Assange  (“Assange”);  Donald  J.  Trump 
for  President,  Inc.  (“the  Trump  Campaign”);  Donald  J.  Trump,  Jr.  (“Trump,  Jr.”);  Paul  J.  Manafort; 
Jr.  (“Manafort”);  Roger  J.  Stone,  Jr.  (“Stone”);  Jared  C.  Kushner  (“Kushner”);  George 
Papadapoulos  (“Papadapoulos”);  and  Richard  W.  Gates,  III  (“Gates”);  and  alleges  as  follows: 

NATURE  OF  ACTION 

I.  INTRODUCTION 

1.  No  one  is  above  the  law.  In  the  run-up  to  the  2016  election,  Russia  mounted  a 
brazen  attack  on  American  democracy.  The  opening  salvo  was  a  cyberattack  on  the  DNC,  carried 
out  on  American  soil.  In  2015  and  2016,  Russian  intelligence  services  hacked  into  the  DNC’s 
computers,  penetrated  its  phone  systems,  and  exfiltrated  sensitive  and  valuable  trade  secrets  and 
tens  of  thousands  of  documents  and  emails.  Russia  then  used  this  stolen  information  to  advance 
its  own  interests:  destabilizing  the  U.S.  political  environment,  denigrating  the  Democratic 
presidential  nominee,  and  supporting  the  campaign  of  Donald  J.  Trump  (“Trump”),  whose  policies 
would  benefit  the  Kremlin. 

2.  In  the  Trump  campaign,  Russia  found  a  willing  and  active  partner  in  its  efforts.  In 
2016,  individuals  tied  to  the  Kremlin  notified  the  Trump  campaign  that  Russia  intended  to  interfere 
with  our  elections.  Through  multiple  meetings,  emails,  and  other  communications,  these  Russian 
agents  made  clear  that  their  government  supported  Trump  and  was  prepared  to  use  stolen  emails 
and  data  to  damage  his  opponent  and  the  Democratic  party. 

3.  Rather  than  report  these  repeated  messages  that  Russia  intended  to  interfere  with 
U.S.  elections,  the  Trump  Campaign  and  its  agents  gleefully  welcomed  Russia’s  help.  Indeed,  the 
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Trump  Campaign  solicited  Russia’s  illegal  assistance,  and  maintained  secret  communications  with 
individuals  tied  to  the  Russian  government,  including  an  intelligence  agency  responsible  for 
attacking  the  DNC. 

4.  Through  these  communications,  the  Trump  Campaign,  Trump’s  closest  advisors, 
and  Russian  agents  formed  an  agreement  to  promote  Donald  Trump’s  candidacy  through  illegal 
means.  Consistent  with  that  agreement,  Russian  agents  trespassed  onto  the  DNC’s  computer 
network  in  the  United  States,  broke  into  DNC  email  accounts,  collected  trade  secrets  and  other 
private  data,  and  disseminated  the  information  at  times  when  it  would  best  suit  the  Trump 
Campaign.  Russia  released  some  of  the  stolen  materials  through  “Guccifer  2.0,”  a  fictitious  online 
persona  created  by  Russian  military  intelligence  (GRU)  officers,  and  released  other  materials 
through  WikiLeaks,  whose  founder,  Assange,  shared  Defendants’  common  goal  of  damaging  the 
Democratic  party  in  advance  of  the  election. 

5.  As  stolen  DNC  information  was  strategically  released  into  the  public  sphere,  then- 
candidate  Trump  openly  praised  the  illegal  disseminations  and  encouraged  Russia  to  continue  its 
violations  of  U.S.  law  through  its  ongoing  hacking  campaign  against  the  Democratic  party. 

II.  OVERVIEW  OF  THE  CONSPIRACY 

6.  Russia’s  cyberattack  on  the  DNC  began  only  weeks  after  Trump  announced  his 
candidacy  for  President  of  the  United  States  in  June  of  2015.  And,  within  months,  allied  European 
intelligence  services  began  reporting  suspicious  communications  between  Trump  associates  and 
Russian  operatives  to  their  U.S.  counterparts. 

7.  On  or  about  October  28,  2015,  while  campaigning  for  President,  Trump  himself 
signed  a  letter  of  intent  to  develop  and  license  his  name  to  a  new  real  estate  project  in  Moscow — 
potentially  fulfilling  a  decades-long  dream.  This  project  was  to  be  financed  through  a  Russian  hank 
under  sanction  by  the  United  States.  The  deal  was  brokered  by  Felix  Sater,  a  Russian  emigre, 
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convicted  felon,  and  longtime  business  partner  of  Trump.  In  explaining  the  deal  to  Michael  Cohen 
(“Cohen”),  Trump’s  personal  attorney,  Sater  suggested  that  he  would  get  Russian  President 
Vladimir  V.  Putin  (“Putin”)  to  support  the  project  in  an  effort  to  boost  Trump’s  electoral  hopes:  “I 
will  get  Putin  on  this  program  and  we  will  get  Donald  elected  ....  I  know  how  to  play  it  and  we 
will  get  this  done.  Buddy  our  boy  can  become  President  of  the  USA  and  we  can  engineer  it.  I  will 
get  all  of  Putins  team  to  buy  in  on  this,  I  will.” 

8.  By  early  2016,  Trump  was  well  on  his  way  to  becoming  the  favorite  to  win  the 
GOP  nomination.  As  Trump  moved  closer  to  securing  the  nomination,  the  ties  between  his 
campaign  and  Russia’s  government  grew  substantially. 

9.  In  February  2016,  retired  Lt.  Gen.  Michael  T.  Flynn  (“Flynn”)  began  serving  as  an 
informal  foreign  policy  advisor  to  the  Trump  campaign.  Just  months  earlier,  on  December  10, 
2015,  Flynn  had  been  paid  by  the  Russian  government- funded  propaganda  outlet  Russia  Today 
(“RT”)  to  attend  and  speak  at  its  anniversary  gala  in  Moscow,  where  he  dined  at  the  same  table  as 
Putin. 

10.  On  March  28,  2016,  Trump  hired  Manafort,  who  had  spent  the  previous  decade 
working  to  advance  Kremlin  interests,  as  his  campaign’s  convention  manager.  Even  after  joining 
the  Trump  campaign,  Manafort  maintained  contact  with  an  individual  tied  to  the  GRU.  Manafort 
also  offered  to  brief  a  Putin-connected  Russian  regarding  the  campaign. 

11.  On  April  18,  2016,  GRU  operatives  successfully  hacked  into  the  DNC’s  computer 
network  and  began  planning  the  staged  release  of  stolen  information  to  influence  the  2016 
elections.  And,  on  April  22,  2016,  GRU  operatives  prepared  large  amounts  of  data  for  exfiltration 
from  DNC  servers.  Four  days  later,  on  April  26,  2016,  Trump’s  foreign  policy  advisor, 
Papadopoulos,  met  with  a  Kremlin-tied  agent,  who  informed  Papadopoulos  that  the  Russians 
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“have  dirt”  on  the  Democratic  presidential  nominee  in  the  form  of  “thousands  of  emails.” 
Papadopoulos  did  not  report  this  information  to  American  law  enforcement.  Rather,  he  reported 
back  to  his  superiors  at  the  Trump  Campaign,  regarding  “interesting  messages  coming  in  from 
Moscow  about  a  trip  when  the  time  is  right.”  On  April  27,  2016 — the  day  after  Papadopoulos ’s 
meeting — Trump  gave  his  first  major  foreign  policy  address,  where  he  spoke  about  “improved 
relations  with  Russia.”  That  evening,  Papadopoulos  flagged  the  speech  for  one  of  his  Russian 
contacts,  and  explained:  “That’s  the  signal  to  meet.” 

12.  By  June  1,  2016,  Russia  had  stolen  thousands  of  DNC  documents  and  emails, 
including  trade  secrets.  On  June  3,  2016,  Russians  connected  to  the  Kremlin  contacted  Donald 
Trump,  Jr.  to  offer  damaging  information  about  the  Democratic  presidential  nominee  as  “part  of 
Russia  and  its  government’s  support  for  Mr.  Trump.”  Trump,  Jr.  did  nothing  to  alert  American  law 
enforcement.  Rather,  he  expressly  embraced  the  illegal  plan,  responding:  “I  love  it  especially  later 
in  the  summer.” 

13.  On  June  9,  2016,  Trump  Jr.,  Manafort,  and  Kushner  met  with  the  Kremlin- 
connected  Russians  in  Trump  Tower.  Trump  and  Trump  Jr.  have  both  told  multiple,  conflicting 
stories  about  what  happened  in  the  meeting.  The  day  after  the  meeting,  the  GRU  placed  spy 
software  on  a  DNC  backup  computer  server. 

14.  On  June  15,  2016,  GRU  agents  began  disseminating  to  the  public  a  trove  of 
documents  stolen  from  the  DNC  and  other  Democratic  party  targets.  The  GRU  continued  these 
releases  through  Election  Day  in  November  2016.  Some  documents  were  disseminated  through 
“Guccifer  2.0,”  a  fictitious  persona  created  by  GRU  agents,  and  others  were  disseminated  through 
WikiLeaks. 
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15.  On  June  22,  2016,  WikiLeaks  contacted  Guccifer  2.0  to  request  new  stolen  DNC 
materials.  In  subsequent  exchanges,  WikiLeaks  explained  that  Trump  had  a  “25  percent  chance” 
of  defeating  the  Democratic  presidential  nominee  and  suggested  that  his  odds  might  improve  if 
WikiLeaks  could  disseminate  stolen  documents  that  would  create  conflict  among  Democrats 
during  the  upcoming  Democratic  National  Convention. 

16.  On  July  11,  2016,  the  Trump  Campaign  intervened  to  prevent  other  Republicans 
from  inserting  anti-Russian  language  regarding  Ukraine  into  the  GOP  platform. 

17.  Between  July  14,  2016  and  July  18,  2016,  GRU  operatives  transmitted  stolen  DNC 
documents  to  WikiLeaks,  which  promised  to  release  them  in  time  to  disrupt  the  Democratic 
National  Convention. 

18.  WikiLeaks  delivered  on  that  promise:  on  July  22,  2016,  three  days  before  the  start 
of  the  Convention,  WikiLeaks  began  disseminating  stolen  DNC  documents,  including  emails  and 
other  sensitive  proprietary  materials,  to  the  public.  The  result  was  chaos — the  DNC  had  to  change 
its  anticipated  speakers,  and  DNC  employees  were  flooded  with  so  many  threatening  phone  calls 
and  emails  that  it  was  difficult  to  use  their  phones  to  carry  out  their  plans  for  the  Convention. 

19.  Throughout  the  summer  and  fall  of  2016,  during  the  height  of  the  Presidential 
campaign,  Trump’s  associates  continued  to  communicate  secretly  with  Russian  agents  and 
WikiLeaks,  who  strategically  disseminated  information  stolen  from  Democratic  targets.  For 
example,  in  August  2016,  Stone  began  communicating  secretly  with  GRU  operatives  and  bragged 
about  his  contacts  with  Assange.  Similarly,  Gates,  who  served  as  the  Trump  Campaign’s  deputy 
chairman  and  then  liaison  to  the  Republican  National  Committee,  maintained  secret 
communications  with  an  individual  he  knew  to  be  connected  to  the  GRU. 
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20.  In  the  summer  and  fall  of  2016,  Stone  revealed  information  that  he  could  not  have 
had  unless  he  were  communicating  with  WikiLeaks,  Russian  operatives,  or  both  about  their 
hacking  operations  in  the  United  States.  For  instance,  in  August  of  2016,  nobody  in  the  public 
sphere  knew  that  Russia  had  stolen  emails  from  John  Podesta,  the  chairman  of  Secretary  Hillary 
Clinton’s  presidential  campaign.  Nevertheless,  on  August  21, 2016,  Stone  predicted  that  damaging 
information  about  Podesta  would  be  released,  tweeting  “it  will  soon  [be]  the  Podesta’s  time  in  the 
barrel.”  Weeks  later,  WikiLeaks  began  releasing  batches  of  Podesta’s  emails  on  a  near-daily  basis 
until  Election  Day — as  Stone  had  predicted.  Similarly,  in  mid-September  2016,  Stone  said  that  he 
expected  “Julian  Assange  and  the  WikiLeaks  people  to  drop  a  payload  of  new  documents  on 
Hillary  [Clinton]  on  a  weekly  basis  fairly  soon.”  And,  beginning  on  October  7,  2016,  WikiLeaks 
began  releasing  stolen  emails  at  least  once  a  week — as  Stone  had  predicted. 

21.  In  September  2016,  GRU  agents  illegally  gained  access  to  DNC  computers  hosted 
on  a  third-party  cloud  computing  service,  stole  large  amounts  of  the  DNC’s  private  data  and 
proprietary  computer  code,  and  exfiltrated  the  stolen  materials  to  their  own  cloud-based  accounts 
registered  with  same  service.  During  this  same  period,  GRU  agents  and  Stone  discussed  highly 
confidential  and  strategic  information  that  had  been  stolen  from  another  Democratic  party 
institution  and  disseminated  to  the  public. 

22.  Around  that  time,  Trump,  Jr.  also  secretly  communicated  with  WikiLeaks.  In  one 
exchange,  WikiLeaks  sent  Trump,  Jr.  a  direct  message  on  Twitter  with  a  password  to  an  anti- 
Trump  website.  In  exchange  for  providing  the  password,  WikiLeaks  asked  Trump,  Jr.  to  have  his 
father  retweet  a  link  to  WikiLeaks’  trove  of  stolen  emails.  Fifteen  minutes  later,  Trump  tweeted  a 
message  about  the  media’s  lack  of  attention  to  WikiLeaks.  On  information  and  belief,  Assange  is 
the  individual  who  operated  the  WikiLeaks  twitter  handle  during  this  interaction. 
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23.  Throughout  the  fall  of  2016,  Trump  praised  the  illegal  dissemination  of  DNC  and 
other  Democratic  documents,  at  various  points  making  it  a  central  theme  of  his  speeches  and 
rallies.  Indeed,  Trump  repeatedly  praised  the  illegal  disseminations  with  exclamations  such  as:  “I 
love  Wikileaks!” 

24.  On  November  9,  2016,  Trump  won  the  Presidency  of  the  United  States.  The 
reaction  in  Russia  was  jubilation,  with  a  member  of  Russia’s  parliament  announcing  to  his  fellow 
legislators:  “I  congratulate  you  all  on  this.” 

25.  The  conspiracy  constituted  an  act  of  previously  unimaginable  treachery:  the 
campaign  of  the  presidential  nominee  of  a  major  party  in  league  with  a  hostile  foreign  power  to 
bolster  its  own  chance  to  win  the  Presidency.  And,  in  carrying  out  this  effort,  Defendants  conspired 
to  disseminate  documents  stolen  from  the  DNC  in  violation  of  the  laws  of  the  United  States,  as 
well  as  the  laws  of  the  Commonwealth  of  Virginia  and  the  District  of  Columbia.  Under  the  laws 
of  this  nation,  Russia  and  its  co-conspirators  must  answer  for  their  actions. 

III.  DAMAGES  TO  THE  DNC 

26.  The  illegal  conspiracy  inflicted  profound  damage  upon  the  DNC.  Defendants 
undermined  the  DNC’s  ability  to  communicate  the  party’s  values  and  vision  to  the  American 
electorate;  sowed  discord  within  the  Democratic  party  at  a  time  when  party  unity  was  essential  to 
electoral  success;  and  seriously  compromised  the  DNC’s  internal  and  external  communications. 

27.  Additionally,  during  its  breaches  of  the  DNC’s  servers,  the  GRU  stole  highly 
confidential  and  proprietary  data,  including  information  concerning  the  ways  in  which  the  DNC 
analyzed  its  data,  developed  its  strategies,  and  approached  decisions  in  its  efforts  to  win  the  2016 
election. 
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28.  The  GRU  also  stole  proprietary  computer  code  that  DNC  computer  engineers  spent 
many  hours  developing.  The  DNC  derived  significant  economic  value  from  keeping  that  computer 
code  secret  until  it  was  taken  by  Russian  agents. 

29.  At  the  same  time,  Defendants’  conduct  resulted  in  a  dramatic  drop  in  donations  to 
the  DNC.  The  dissemination  of  hacked  information  heightened  donors’  concerns  that  confidential 
information  disclosed  through  their  contributions  might  be  publicly  disseminated. 

30.  The  DNC  also  paid  more  than  a  million  dollars  to  repair  and  remediate  electronic 
equipment,  and  to  hire  staff  and  consultants  to  address  the  cyber-security  fallout  from  the  hack  and 
dissemination. 

31.  Finally,  because  the  releases  included  personal,  and  in  some  cases  protected 
information  about  DNC  employees,  some  DNC  employees  were  exposed  to  harassment  and  death 
threats.  One  representative  email  said:  “I  hope  all  your  children  get  raped  and  murdered.  I  hope 
your  family  knows  nothing  but  suffering,  torture  and  death.”  Understandably,  this  harassment 
impaired  the  employees’  ability  to  function  effectively  in  their  jobs. 

32.  While  no  suit  can  ever  fully  redress  the  harm  that  Defendants’  illegal  conduct 
exacted,  the  DNC  brings  this  lawsuit  to  seek  the  full  measure  of  relief  afforded  by  the  laws  of  the 
United  States.  Accordingly,  Plaintiff  brings  claims  under  the  statutes  and  common  law  discussed 
herein.  Plaintiff  is  entitled  to  relief  from  every  member  of  Defendants’  illegal  scheme. 

JURISDICTION  AND  VENUE 

33.  This  Court  has  federal  question  jurisdiction  pursuant  to  28  U.S.C.  §  1331  because 
this  action  arises  under  1 8  U.S.C.  §  1030  (the  Computer  Fraud  and  Abuse  Act);  1 8  U.S.C.  §  §  1961- 
68  (Racketeer  Influenced  and  Corrupt  Organizations  Act);  18  U.S.C.  §§  2701-11  (the  Stored 
Communications  Act);  28  U.S.C.  §§  2510-22  (commonly  referred  to  as  the  Federal  Wiretap  Act); 
Pub.  L.  No.  114-152,  130  Stat.  376  (the  Defend  Trade  Secrets  Act,  codified  in  scattered  sections 
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of  18  U.S.C.  and  28  U.S.C.);  and  17  U.S.C.  §  1201  etseq.  (the  Digital  Millennium  Copyright  Act). 
This  Court  has  supplemental  jurisdiction  over  Plaintiffs  state  law  claims  pursuant  to  28  U.S.C. 
§  1367(b). 

34.  This  Court  has  jurisdiction  over  the  claims  against  Russia  and  the  GRU  pursuant  to 
28  U.S.C.  §  1330  because  Russia  is  a  foreign  state,  see  28  U.S.C.  §  1603(a),  and  the  GRU  is  an 
“agency  or  instrumentality”  of  the  state,  28  U.S.C.  §  1603(b). 

35.  Russia  is  not  entitled  to  sovereign  immunity  because  the  DNC’s  claims  arise  out  of 
Russia’s  trespass  on  the  DNC’s  private  servers  and  conversion  of  the  DNC’s  property —  tortious 
acts  committed  in  the  United  States.  See  28  U.S.C.  §  1605(a)(5).  In  addition,  Russia  stole  trade 
secrets,  a  form  of  commercial  activity  undertaken  in  and  directly  affecting  the  United  States.  See 
id.  §  1605(a)(2).  Finally,  Russia  purchased  computer  servers  in  the  United  States  and  made  other 
payments  in  furtherance  of  hacking  activity,  another  form  of  commercial  activity  undertaken  in 
and  directly  affecting  the  United  States. 

36.  Venue  is  proper  in  this  Court  under  28  U.S.C.  §  1391(b)(2)  because  a  substantial 
part  of  the  events  giving  rise  to  the  claims  occurred  in  New  York  City,  NY.  The  Trump  Campaign 
is  headquartered  at  725  Fifth  Avenue,  New  York  City,  NY  10022;  Trump,  Jr.  resides  in  New  York 
City,  NY;  and  a  substantial  number  of  the  meetings  and  interactions  made  in  furtherance  of  the 
conspiracy  at  issue  were  located  in  New  York  City,  NY. 

37.  Venue  is  proper  for  the  claims  arising  under  RICO  pursuant  to  1 8  U.S.C.  §  1965(a) 
because  Defendants  reside,  are  found,  have  agents,  or  transact  affairs  in  New  York  City,  NY. 

PARTIES 

38.  Plaintiff  DNC,  registered  with  the  Federal  Election  Commission  as  DNC  Services 
Corp./Dem.  Nat’ 1  Committee,  is  a  national  committee  as  that  term  is  defined  by  and  used  in  52 
U.S.C.  §  30101,  dedicated  to  electing  local,  state,  and  national  candidates — including  presidential 
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candidates — of  the  Democratic  Party  to  public  office.  To  accomplish  its  mission,  the  DNC,  among 
other  things,  works  closely  with  Democratic  public  officials  and  assists  state  parties  and  candidates 
by  contributing  money,  making  expenditures  on  their  behalves,  and  providing  active  support 
through  the  development  of  programs  benefiting  Democratic  candidates.  The  DNC  also  plans  the 
Democratic  Party’s  presidential  nominating  convention  and  promotes  the  Democratic  Party’s 
platform.  The  DNC  regularly  conducts  its  business  via  email  housed  on  secured  servers.  It  also 
regularly  creates  and  maintains  copyrighted  materials  on  its  servers  as  well  as  confidential, 
proprietary  documents  related  to  campaigns,  fundraising,  and  campaign  strategy  that  are  the 
DNC’s  trade  secrets.  Additionally,  the  DNC’s  servers  contain  valuable,  proprietary  computer  code 
written  by  DNC  employees. 

39.  Defendant  Russia  is  a  foreign  state  as  defined  under  the  laws  of  the  United  States. 

40.  Defendant  GRU  is  Russia’s  military  intelligence  agency.  GRU  Unit  26165,  located 
at  20  Komsomolskiy  Prospekt,  in  Moscow,  Russia,  was  primarily  responsible  for  the  GRU’s 
cyberattacks  on  the  DNC.  GRU  Unit  74455,  located  at  22  Khirova  Street,  Khimki,  Moscow,  aided 
in  the  dissemination  of  stolen  DNC  information  through  fictitious  online  personas.  The  GRU 
created  a  fictitious  online  persona  named  “Guccifer  2.0,”  who  publicly  took  responsibility  for  the 
hacks  on  the  DNC.  Guccifer  2.0  claimed  to  be  a  Romanian  hacker  with  no  relationship  with  Russia. 
Upon  information  and  belief,  the  GRU  created  Guccifer  2.0  to  hide  its  role  in  the  cyberattack  on 
the  DNC.  Guccifer  2.0  disseminated  thousands  of  stolen  documents  and  emails,  through  both  a 
GRU-operated  website  and  through  a  website  operated  by  WikiLeaks. 

4 1 .  Defendant  Aras  Agalarov  is  an  Azeri-bom  oligarch  in  Russia  who  is  a  close  ally  of 
Putin.  Trump  worked  with  Aras  Agalarov,  who  served  as  a  liaison  between  Trump  and  Putin,  to 
bring  the  Miss  Universe  pageant  to  Moscow  in  20 1 3,  for  which  Aras  Agalarov  paid  Trump  millions 
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of  dollars.  Trump  and  Aras  Agalarov  also  agreed  on  another  deal  to  explore  real  estate 
opportunities  in  Russia  together.  Aras  Agalarov  reportedly  has  land  reserved  in  Russia  for  a 
Trump-branded  real  estate  development. 

42.  Defendant  Emin  Agalarov  is  Aras  Agalarov’ s  son.  Emin  Agalarov  is  a  pop  singer 
and  executive  at  the  family’s  real  estate  company.  He  established  a  close  relationship  with  the 
Trumps  over  the  course  of  their  partnership  on  the  2013  Miss  Universe  pageant,  and  was  closely 
involved  in  negotiations  with  Trump  and  Trump  Jr.  on  a  deal  to  build  a  Trump-branded  real  estate 
development  in  Moscow.  Like  his  father,  Emin  Agalarov  remained  in  contact  with  Trump  and 
Trump,  Jr.  after  2013  and  into  the  2016  campaign.  The  Agalarovs  figure  prominently  in  the  June 
2016  Trump  Tower  meeting  (described  below). 

43.  Defendant  Mifsud  is  an  academic  who,  upon  information  and  belief,  worked  in 
several  positions  for  the  government  of  Malta.  Mifsud  apparently  had  affiliations  with  a  variety  of 
educational  organizations  and  institutions  in  the  United  Kingdom  and  Malta.  Upon  information 
and  belief,  Mifsud  has  substantial  connections  to  the  Russian  government  and  acted  as  a  de  facto 
agent  of  the  Russian  government  in  his  contacts  with  Papadopoulos  in  2016. 

44.  Defendant  Assange  is  the  founder  and  publisher  of  WikiLeaks.  He  is  a  citizen  of 
Australia  and  resides  in  the  embassy  of  the  Government  of  Ecuador  in  London,  England.  Assange 
has  exhibited  support  for  the  Russian  government  and  has  hosted  a  talk  show  on  RT,  a  television 
propaganda  outlet  funded  by  the  Russian  government.  Upon  information  and  belief,  Assange  was 
the  only  individual  who  used  WikiLeaks’  Twitter  handle  in  2016. 

45.  Defendant  WikiLeaks  is  an  international  organization  of  unknown  structure  that 
operates  a  website,  WikiLeaks.org,  on  which  it  publishes  leaked  or  stolen  confidential  and 
classified  information.  Its  maintains  a  post  office  box  in  the  United  States — P.O.  Box  701,  San 
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Mateo,  CA  94401 — and  a  mailbox  at  the  University  of  Melbourne  in  Victoria,  Australia,  but  it  is 
not  clear  whether  WikiLeaks  uses  or  conducts  business  through  those  mailboxes. 

46.  Defendant  Trump  Campaign  is  an  American  not-for-profit  corporation  formed  and 
registered  in  Virginia  on  June  17,  2015  to  support  Trump’s  candidacy  for  President  of  the  United 
States.  The  Trump  Campaign  is  incorporated  under  the  laws  of  Virginia  and  has  or  had  an  office 
at  675  N.  Washington  St.,  Alexandria,  VA  22314.  Its  principal  place  of  business  is  Trump  Tower, 
725  Fifth  Avenue,  New  York  City,  NY  10022.  From  June  2015  to  June  2016,  Corey  Lewandowski 
was  Campaign  Manager  of  the  Trump  Campaign.  From  March  2016  to  May  2016,  Manafort  was 
Convention  Manager  of  the  Trump  Campaign,  and  from  May  2016  to  August  2016,  he  was 
Campaign  Chairman  of  the  Trump  Campaign.  From  June  2016  to  August  2016,  Gates  was  Deputy 
Campaign  Chairman,  and  from  August  2016  to  November  2016,  he  was  the  campaign’s  liaison  to 
the  Republican  National  Committee.  Multiple  senior  members  of  the  Trump  Campaign  are 
reported  to  have  long-time  ties  to  Russia  and  to  have  engaged  in  frequent  communication  with 
individuals  tied  to  the  Russian  government  during  the  2016  campaign  cycle. 

47.  Defendant  Trump,  Jr.  is  Trump’s  oldest  son.  From  at  least  June  16,  2015,  until 
November  8,  2016,  when  Trump  was  a  Republican  candidate  for  president,  Trump,  Jr.  was  a  close 
political  advisor  to  his  father.  Trump,  Jr.  currently  works  as  Executive  Vice  President  of  the  Trump 
Organization,  the  business  organization  that  was  run  by  Trump  before  his  inauguration.  Trump,  Jr. 
resides  in  New  York  City,  New  York. 

48.  Defendant  Manafort  is  a  long-time  Republican  political  operative,  who  was 
Convention  Manager  of  the  Trump  Campaign  from  March  2016  to  May  2016,  and  Campaign 
Chairman  of  the  Trump  Campaign  from  May  2016  to  August  2016,  when  he  resigned  amid  reports 
of  his  work  with  the  formerly  pro-Russian  government  in  Ukraine.  In  September  2018,  Manafort 
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pleaded  guilty  to  two  counts  of  conspiracy  against  the  United  States,  encompassing  charges  of 
money  laundering,  tax  fraud,  failure  to  register  as  a  foreign  agent,  and  other  criminal  violations 
related  to  his  work  for  the  pro-Russian  government  in  Ukraine.  Manafort  is  currently  in  federal 
custody  at  the  William  G.  Truesdale  Adult  Detention  Center  in  Alexandria,  Virginia. 

49.  Defendant  Stone  is  Trump’s  long-time  confidant.  “[F]ew  people  go  as  far  back  [as] 
Trump  [and]  Stone,”  and  Stone  has  “nurtured  the  dream  of  a  [Trump]  presidential  run  ...  for  30 
years.”1  Stone  also  has  a  long  history  with  Manafort:  Manafort  helped  run  Stone’s  campaign  for 
national  chairman  of  the  Young  Republicans  in  1977,  and  the  two  co-founded  a  consulting  firm — 
Black,  Manafort,  Stone,  and  Kelly — in  the  1980s.  In  2007,  Stone  worked  on  the  parliamentary 
campaign  of  a  Ukrainian  candidate  who  formed  a  coalition  with  pro-Russian  politician  Viktor 
Yanukovych,  whose  closest  political  advisor  was  Manafort.  Upon  information  and  belief,  Stone 
served  as  an  informal  adviser  to  Trump  and  remained  in  contact  with  him  and  other  senior  officials 
in  the  Trump  Campaign  throughout  the  2016  election.  Stone  resides  in  Florida. 

50.  Defendant  Kushner  is  Trump’s  son-in-law  and  was  a  senior  advisor  to,  and  one  of 
the  key  decision-makers  for,  the  Trump  Campaign.  In  June  2016,  Kushner  assumed  responsibility 
for  the  campaign’s  “data-driven  efforts,”  setting  up  a  100-person  “data  hub”  in  San  Antonio, 
Texas,  and  hiring  Cambridge  Analytica,  a  social  media  and  analytics  firm  to  help  his  father-in- 
law’s  campaign.  Kushner  resides  in  Washington,  D.C. 

5 1 .  Defendant  Papadopoulos  was  one  of  the  earliest  foreign  policy  advisors  to  the 
Trump  campaign.  He  became  a  foreign  policy  adviser  to  the  Trump  Campaign  in  March  2016. 
Papadopoulos  was  in  frequent  contact  with  the  Trump  Campaign’s  most  senior  officials,  including 
Manafort  and  Gates,  in  the  summer  and  fall  of  2016.  He  resides  in  Chicago,  Illinois.  On  October 
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5,  2017,  Papadopoulos  pleaded  guilty  to  one  count  of  making  a  false  statement  to  a  federal  agent 
about  his  contacts  with  individuals  connected  to  the  Russian  government. 

52.  Defendant  Gates  is  a  longtime  employee  and  business  partner  of  Manafort. 
Between  2006  and  2015,  Gates  was  closely  involved  in  Manafort’s  work  for  the  former  pro- 
Russian  regime  in  Ukraine  and  its  successor  political  party.  On  February  23,  2018,  Gates  pleaded 
guilty  to  one  count  of  conspiracy  against  the  United  States  and  one  count  of  making  a  false 
statement  to  a  federal  agent,  both  related  to  his  work  with  Manafort  for  the  pro-Russian 
government  in  Ukraine.  Gates  resides  in  Richmond,  VA. 

53.  Defendants  carried  out  their  conspiratorial  goals  with  the  help  of  several  GRU 
officers  (the  “GRU  Operatives”),  who  are  listed  below. 

NON-PARTY  CO-CONSPIRATORS  (THE  GRU  OPERATIVES) 

54.  Viktor  Borisovich  Netyksho  (“Netyksho”)  was  the  Russian  military  officer  in 
command  of  GRU  Unit  26165  in  2016.  That  unit  is  located  at  20  Komsomolskiy  Prospekt, 
Moscow,  Russia.  Unit  26165  was  primarily  responsible  for  the  hacking  the  DNC’s  servers  and 
cloud  computing  service. 

55.  Boris  Alekseyevich  Antonov  (“Antonov”)  was  a  Major  in  the  Russian  military  in 
2016.  That  year,  Antonov  was  the  head  of  a  department  within  Unit  26165  that  was  dedicated  to 
computer  intrusion  activity.  Antonov  supervised  other  GRU  officers  who  hacked  the  DNC’s 
servers  and  cloud  computing  service. 

56.  Dmitriy  Sergeyevich  Badin  (“Badin”)  was  a  the  “Assistant  Head”  of  Antonov’s 
department  within  Unit  26165  in  2016.  Badin  worked  with  Antonov  to  supervise  other  GRU 
officers  who  hacked  the  DNC’s  servers  and  cloud  computing  service. 
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57.  Ivan  Sergeyevich  Yermakov  (“Yermakov”)  was  a  Russian  military  officer  assigned 
to  Antonov’s  department  within  Unit  26165  in  2016.  In  or  around  May  2016,  Yermakov 
participated  in  an  operation  to  hack  a  DNC  email  server  and  steal  DNC  emails. 

58.  Sergey  Aleksandrovich  Morgachev  (“Morgachev”)  was  a  Lieutenant  Colonel  in  the 
Russian  military  assigned  to  Unit  26165  in  2016.  Morgachev  oversaw  a  department  within  Unit 
26165  that  developed  and  managed  malware  (i.e.,  software  that  damages,  disables,  or  spies  upon 
computer  systems).  Morgachev  supervised  the  GRU  officers  who  placed  and  monitored  malware, 
including  a  proprietary  GRU  tool  called  X- Agent,  on  the  DNC’s  computer  network. 

59.  Nikolay  Yuryevich  Kozachek  (“Kozachek”)  was  a  Lieutenant  Captain  in  the 
Russian  military  assigned  to  Morgachev’ s  department  within  Unit  26165  in  2016.  In  or  around 
April  2016,  Kozachek  developed,  customized,  and  monitored  the  X- Agent  malware  used  on  the 
DNC’s  computer  network. 

60.  Pavel  Vyacheslavovich  Yershov  (“Yershov”)  was  a  Russian  military  officer 
assigned  to  Morgachev’ s  department  within  Unit  26165  in  2016.  Yershov  helped  Kozachek  and 
other  GRU  officers  test  and  customize  X-Agent  malware  before  it  was  placed  on  the  DNC’s 
network. 

61.  Artem  Andreyevich  Malyshev  (“Malyshev”)  was  a  Second  Lieutenant  in  the 
Russian  military  assigned  to  Morgachev’s  department  within  Unit  26165  in  2016.  In  or  around 
2016,  Malyshev  monitored  the  X-Agent  malware  on  the  DNC’s  computer  network. 

62.  Aleksandr  Vladimirovich  Osadchuk  (“Osadchuk”)  was  a  Colonel  in  the  Russian 
military  and  the  commanding  officer  of  GRU  Unit  74455  in  2016.  That  unit  is  located  at  22  Kirova 
Street,  Khimki,  Moscow.  Unit  74455  helped  release  stolen  DNC  materials  through  the  online 
persona  Guccifer  2.0. 
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63.  Aleksey  Aleksandrovich  Potemkin  (“Potemkin”)  was  an  officer  in  the  Russian 
military  assigned  to  Unit  74455  in  2016.  Potemkin  supervised  a  department  within  Unit  74455  that 
created  computer  infrastructure  and  social  media  accounts  that  were  used  in  the  dissemination  of 
stolen  DNC  materials  through  Guccifer  2.0. 

GENERAL  ALLEGATIONS 

IV.  SEVERAL  DEFENDANTS’  PRE-EXISTING  RELATIONSHIPS  WITH  RUSSIA 
AND  RUSSIAN  OLIGARCHS  PROVIDED  FERTILE  GROUND  FOR  A 
CONSPIRACY 

64.  Trump,  several  Trump  Associates,*  and  Assange’s  long-standing  personal, 
professional,  and  financial  ties  to  Russia  and  numerous  individuals  closely  linked  to  the  Russian 
government  provided  fertile  ground  for  a  conspiracy  between  Defendants  to  interfere  in  the  2016 
elections. 

65.  Trump  ’s  Business  Connections  to  Russia:  As  early  as  the  1 980s,  the  Soviet  Union 
paid  for  Trump  to  travel  to  Moscow  to  discuss  a  potential  development  project — a  pattern  which 
continued  into  the  1990s  and  2000s.2  In  the  mid-1990s,  Trump  negotiated  with  Russian 
government  officials  over  potential  real  estate  developments  in  Moscow.3  Beginning  in  2003, 
Trump  engaged  in  multiple  real  estate  deals  with  the  Bayrock  Group,  a  firm  founded  and  run  by 
Soviet  emigres,  who  reportedly  had  close  ties  to  the  Russian  government  and  Russian  organized 
crime.4  In  2004,  Trump  negotiated  with  the  Deputy  Mayor  of  Moscow  over  a  potential  real  estate 
development.5  In  the  mid-2000s,  Trump  partnered  with  wealthy  Russian-Canadian  businessmen 
to  develop  real  estate  in  Toronto.6  And  in  2006,  Trump  contracted  with  the  Russian  Standard 
Corporation,  a  Moscow-based  entity  that  owns  and  operates  the  Miss  Russia  beauty  pageant,  to 

*  “Trump  Associates”  refers  to  the  Trump  advisors  and  confidants  named  as  Defendants  herein: 
Trump,  Jr.,  Manafort,  Kushner,  Stone,  and  Papadopoulos.  During  the  2016  Presidential  campaign, 
these  individuals  acted  as  agents  of,  and  their  acts  are  attributable  to,  the  Trump  Campaign. 
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allow  the  winner  of  the  pageant  to  compete  in  Trump’s  Miss  Universe  pageant,  an  action  that  had 
not  been  taken  since  at  least  2002. 7  In  2008,  Trump  sold  a  Palm  Beach,  Florida  mansion  to  a 
Russian  oligarch  for  a  $54  million  profit.8  In  2013,  Trump  established  a  business  relationship  with 
Russian  oligarch  Aras  Agalarov,  a  close  ally  of  Putin,  to  bring  the  Miss  Universe  pageant  to  Russia 
and  work  on  plans  to  develop  a  Trump-branded  project  in  Moscow.9  Trump’s  efforts  to  develop 
real  estate  in  Russia  continued  into  May  of  2016 — several  months  into  Trump’s  presidential 
campaign. 10  And  throughout  this  30-year  history,  Trump  sought  out  wealthy  Russian  buyers  for 
his  condominiums  in  the  United  States  and  abroad. 11 

66.  As  Trump,  Jr.  explained,  the  Trump  Organization  “s[aw]  a  lot  of  money  pouring  in 
from  Russia,”  and  “Russians  make  up  a  pretty  disproportionate  cross-section  of  a  lot  of  our 
assets.”12  Trump’s  son  Eric  Trump  has  reportedly  stated  that  substantial  funding  for  Trump’s  golf 
courses  also  comes  from  Russian  investors.13 

67.  Manafort  and  Gates’  Ukrainian  Connections:  From  2004  until  at  least  2015, 
Manafort  was  an  advisor  to  the  Russian-allied  former  Ukrainian  President  Viktor  Yanukovych 
(“Yanukovych”)  and  his  Kremlin-allied  Party  of  Regions,  as  well  as  its  successor,  the  Opposition 
Bloc. 14  In  2012,  Manafort  allegedly  helped  the  Ukrainian  party  secretly  route  at  least  $2.2  million 
in  payments  to  two  prominent  Washington  lobbying  firms.  15  Manafort’s  ties  to  Yanukovych  and 
Ukraine  are  so  deep  that  his  own  daughter  has  stated  that  the  “money  we  have  is  blood  money.”16 
After  repeatedly  denying  that  he  had  ever  worked  for  the  Ukrainian  government,  on  June  27,  2017, 
Manafort  retroactively  registered  as  a  foreign  agent  and  reported  $17.1  million  in  payments  from 
Yanukovych’s  party  between  2012  and  2014. 17  In  September  2018,  Manafort  pleaded  guilty  to 
two  counts  of  conspiracy  against  the  United  States,  encompassing  charges  of  money  laundering, 
tax  fraud,  failure  to  register  as  a  foreign  agent,  and  other  criminal  violations  related  to  his  work  for 
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the  pro-Russian  government  in  Ukraine. 18  According  to  the  U.S.  government,  Manafort’s  work  in 
Ukraine  was  backed  by  Putin-tied  oligarch  Oleg  Deripaska  (“Deripaska”).19  Additional  financial 
records  indicate  that  Manafort  was  in  debt  to  Deripaska  by  as  much  as  $17  million  prior  to  joining 
the  Trump  Campaign.20 

68.  Manafort  also  employed  Konstantin  Kilimnik  (“Kilimnik”)  as  his  close  aide. 
Kilimnik  is  a  former  linguist  in  the  Russian  army  who  is  reportedly  an  agent  of  the  GRU;  the  FBI 
believes  that  Kilimnik  maintained  ties  to  Russian  intelligence  during  the  2016  U.S.  presidential 
campaign.21  Kilimnik  was  in  communication  with  both  Manafort  and  Gates  while  they  were 
serving  in  the  two  most  senior  positions  in  the  Trump  Campaign,  and  acted  as  a  middleman 
between  them  and  Deripaska.22  On  June  8,  2018,  Kilimnik  was  indicted  for  obstruction  of  justice 
related  to  Manafort’s  criminal  charges.23 

69.  Assange’s  Longstanding  Ties  to  Russia:  Assange  has  long  exhibited  support  for 
the  Russian  government.  In  2010,  Assange  tried  to  obtain  a  Russian  visa  to  escape  extradition  to 
Sweden,  where  he  faced  sexual  assault  charges.  He  used  Israel  Shamir,  a  Russian-born  writer  who 
has  been  described  as  “a  fringe  intellectual,”  to  arrange  the  visa.  During  a  January  2011  interview 
with  a  Moscow-based  radio  station,  Shamir  said  he’d  personally  brokered  a  Russian  visa  for 
Assange,  but  that  it  had  come  too  late  to  rescue  Assange  from  the  sex  crimes  investigation.  Russia 
“would  be  one  of  those  places  where  he  [Assange]  and  his  organization  [WikiLeaks]  would  be 
comfortable  operating,”  Shamir  stated.24  Asked  if  Assange  had  friends  in  the  Kremlin,  Shamir 
smiled  and  said,  “Let’s  hope  that’s  the  case.”25  In  2012,  Assange  hosted  a  talk  show  on  RT,  a 
television  propaganda  outlet  funded  by  the  Russian  government. 

70.  Assange’s  alliance  with  the  Russian  government  continues  to  this  day.  In  late  20 1 7, 
Russian  diplomats  met  secretly  with  a  close  confidant  of  Assange  to  assess  whether  they  could 
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help  him  flee  to  Russia.  A  tentative  plan  was  devised  that  would  have  seen  Assange  smuggled  out 
of  Ecuador’s  London  embassy  in  a  diplomatic  vehicle.  The  plan,  which  was  provisionally 
scheduled  to  be  executed  on  Christmas  Eve  2017,  was  abandoned  after  it  was  deemed  too  risky. 
According  to  news  reports,  four  separate  sources  confirmed  the  Kremlin  was  willing  to  support 
the  plan.26 

V.  THE  COMMON  PURPOSE:  BOLSTER  TRUMP  AND  DENIGRATE  THE 

DEMOCRATIC  PARTY  NOMINEE 

71.  The  common  purpose  of  the  Defendants’  conspiracy  was  to  bolster  Trump’s 
campaign  for  president,  to  injure  the  DNC,  and  to  harm  the  Democratic  party’s  chances  for  success 
in  the  2016  presidential  election.  Defendants  worked  toward  this  common  purpose  for  multiple, 
well-documented  reasons. 

72.  In  December  2011,  massive  protests  broke  out  in  Russia  in  response  to  allegations 
of  vote  rigging  and  election  fraud  in  the  Russian  parliamentary  elections.  Thousands  of  Russians 
took  to  the  streets  to  protest  the  victory  of  then-Prime  Minister  Putin’s  political  party,  in  one  of 
Russia’s  largest  protests  since  the  fall  of  the  U.S.S.R.27 

7 3 .  Concerned  about  maintaining  power  and  exerting  control,  Putin  lashed  out,  blaming 
the  protests  on  then- Secretary  of  State  Hillary  Clinton.  Putin  asserted  that  Secretary  Clinton  had 
“set  the  tone  for  some  of  our  actors  in  the  country  and  gave  the  signal.”28  And  he  accused  her  of 
ordering  the  opposition  movement  into  action,  “They  heard  this  and,  with  the  support  of  the  U.S. 
State  Department,  began  active  work.”29 

74.  At  the  same  time,  Trump  left  no  doubt  as  to  his  views  on  Russia.  Prior  to  the  2016 
campaign,  he  spent  nearly  a  decade  espousing  pro-Russian  and  pro-Putin  views,  praising  Putin  as 
“doing  a  great  job  in  rebuilding  the  image  of  Russia”  (2007); 30  stating  that  he  “really  like[d] 
Vladimir  Putin  [and]  respect[ed]  him.  He  does  his  work  well.  Much  better  than  our  Bush”  (2008);31 
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and  characterizing  Putin’s  illegal  annexation  of  Crimea  as  “so  smart.  . .  And  he  [Putin]  really  goes 
step  by  step  by  step,  and  you  have  to  give  him  a  lot  of  credit”  (20 14). 32 

75.  Despite  the  obvious  political  risks  of  associating  himself  with  a  foreign  despot, 
Trump  continued  to  make  laudatory  statements  about  Putin  well  into  the  presidential  primary 
season.  He  said  that  he  would  have  a  “great  relationship  with  Putin”;33  and  that  it  was  a  “great 
honor  to  be  so  nicely  complimented  by  [Putin,  who  was]  so  highly  respected  within  his  own 
country  and  beyond.”34 

76.  Further,  Trump’s  statements — as  well  as  the  pro-Russian  entourage  with  which  he 
surrounded  himself — left  little  doubt  that  Trump,  if  elected  president,  would  adopt  policies  that 
favored  Russia  and  Putin,  even  if  those  policies  conflicted  with  longstanding  U.S.  foreign  policy, 
and  the  best  interests  of  the  United  States.  Trump  called  NATO  “obsolete”  and  threatened  to  renege 
on  U.S.  treaty  obligations;35  argued  that  the  U.S.  should  not  counteract  Russia’s  attempts  to  be  a 
global  power;  supported  the  United  Kingdom’s  exit  from  the  European  Union,  while  noting  that  it 
would  “probably”  benefit  Putin;36  and  opposed  U.S.  sanctions  for  Russia’s  annexation  of  Crimea, 
saying,  “The  people  of  Crimea,  from  what  I’ve  heard  would  rather  be  with  Russia  than  where  they 
were.”37 

77.  In  July  2018,  Putin  confirmed  that  he  had  wanted  Trump  to  win  the  2016 
presidential  election  because  he  believed  Trump’s  policies  would  be  more  favorable  to  the 
Kremlin.38 

78.  Upon  information  and  belief,  the  GRU  and  Mifsud  shared  the  conspirators’ 
common  purpose  because  they  wanted  to  advance  Russia’s  interests  and,  as  noted  above,  Russia 
wanted  Trump  to  become  President. 
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79.  Assange  and  WikiLeaks  also  shared  the  Conspirators’  common  purpose.  Assange 
had  a  long  of  history  conflicts  with  Secretary  Clinton,  and  Assange  publicly  stated  that  his  policy 
disagreements  with  Clinton  would  make  her  presidency  far  more  problematic  than  a  Trump 
presidency.39  In  private  messages  sent  to  GRU  operatives,  WikiLeaks  confirmed  its  goal  of 
harming  Secretary  Clinton’s  candidacy  and  disrupting  the  Democratic  party’s  chances  of  victory 
in  the  2016  presidential  election.40  Upon  information  and  belief,  Assange  drafted  those  messages 
and  relayed  them  through  WikiLeaks.  Upon  information  and  belief,  Assange  is  the  only  individual 
who  uses  WikiLeaks’  Twitter  handle.41 

80.  Upon  information  and  belief,  the  Agalarovs  and  the  Trump  Associates  shared  the 
conspirators’  common  purpose  because  they  stood  to  benefit  financially  and  professionally  from 
a  Trump  Presidency.  Finally,  the  Trump  Campaign’s  stated  goal  was  to  get  Trump  elected. 

VI.  THE  CONSPIRACY  TO  DISSEMINATE  STOLEN  DNC  DATA  TO  AID  TRUMP 

81.  In  a  January  2017  report  (the  “IC  Report”),  the  U.S.  intelligence  community 
concluded:  “Russian  President  Vladimir  Putin  ordered  an  influence  campaign  in  2016  aimed  at  the 
US  presidential  election,  the  consistent  goals  of  which  were  to  undermine  public  faith  in  the  US 
democratic  process,  denigrate  Secretary  Clinton,  and  harm  her  electability  and  potential 
presidency.”42  Further,  the  IC  Report  concluded:  “In  July  2015,  Russian  intelligence  gained  access 
to  Democratic  National  Committee  (DNC)  networks  and  maintained  that  access  until  at  least  June 
2016”;  that  “[b]y  May,  the  GRU  had  exfiltrated  large  volumes  of  data  from  the  DNC”;  and  that 
the  “GRU  relayed  material  it  acquired  from  the  DNC  and  senior  Democratic  officials  to 
WikiLeaks.”43 

82.  This  operation  to  infiltrate  the  DNC  servers  and  disseminate  stolen  DNC  material 
was  carried  out  in  the  United  States:  Russian  operatives  trespassed  onto  computer  servers  located 
in  Virginia  and  Washington,  D.C.  and  stole  information  located  on  those  servers.  The  operation 
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was  also  carried  out  in  concert  with  Assange  and  WikiLeaks,  and  with  the  active  support  and 
approval  of  the  Trump  Campaign  and  the  Trump  Associates. 

83.  The  conspirators  worked  in  tandem  to  accomplish  their  goal.  Russia’s  intelligence 
services  illegally  hacked  into  the  DNC’s  computer  systems  and  email  sever  in  order  to  steal  and 
publish  trade  secrets,  including  confidential,  proprietary  documents  related  to  campaigns, 
fundraising,  and  campaign  strategy.  Russian  intelligence  services  then  disseminated  the  stolen, 
confidential  materials  through  GRU-created  websites,  as  well  as  WikiLeaks  and  Assange,  who 
were  actively  supported  by  the  Trump  Campaign  and  Trump  Associates  as  they  released  and 
disclosed  the  information  to  the  American  public  at  a  time  and  in  a  manner  that  served  their 
common  goals.  The  disclosures  to  the  American  electorate  were  undertaken  with  the  purpose  and 
had  the  effect  of  creating  dissention  within  the  Democratic  party,  directing  media  coverage  away 
from  stories  critical  of  Trump,  and  generally  promoting  Trump’s  presidential  candidacy.44 

A.  Trump  Announces  His  Candidacy  For  President,  And  Russia  Begins  Its 
Attack  On  The  DNC’s  Computer  Systems 

84.  On  June  16,  2015,  Trump  announced  his  candidacy  for  President  of  the  United 
States  in  the  lobby  of  Trump  Tower.  By  the  next  month,  Russia  had  undertaken  its  cyberattack  on 
the  DNC.45  The  hacks  by  Russian  intelligence  were  directed  at  systems  in  Virginia  and 
Washington,  D.C.  that  contained  some  of  the  DNC’s  most  sensitive  strategic  and  operational  data. 
Later,  the  disclosure  of  this  sensitive  data  not  only  significantly  disrupted  the  election  strategy 
implemented  by  the  DNC,  but  also  interfered  directly  with  the  DNC’s  ability  to  effectively 
communicate  with  and  persuade  voters  and  to  raise  critical  funds  for  its  organization  and  to  support 
Democratic  campaigns — all  activities  that  occurred  in  interstate  commerce. 
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B.  European  Allies  Sound  The  Alarm  To  U.S.  Intelligence  Regarding 
Communications  Between  Russians  And  Trump  Associates 

85.  In  late  2015,  European  intelligence  agencies  began  reporting  suspicious 
communications  between  persons  associated  with  the  Trump  Campaign  and  Russian  operatives 
(including  suspected  Russian  intelligence  agents)  to  U.S.  authorities.  These  reports  continued  over 
the  next  year. 

C.  While  Campaigning  For  President,  Trump  Signs  A  Letter  Of  Intent  To  Build 
Trump  Tower  Moscow 

86.  In  the  fall  of  2015,  as  Trump  campaigned  for  President,  members  of  the  Trump 
Organization  were  actively  negotiating  with  Russians  to  build  a  Trump-branded  real  estate  project 
in  Moscow — a  longtime  goal  of  Trump’s.46  On  or  about  October  28, 2015,  Trump  a  letter  of  intent 
to  license  his  name  for  the  project.47 

87.  The  deal  was  brokered  by  Felix  Sater,  a  Russian  emigre,  convicted  felon,  and 
longtime  business  associate  of  the  Trump  Organization.48  The  funding  for  the  project  was  to  be 
provided  by  Vneshtorgbank,  or  VTB — a  Russian  bank  against  which  the  United  States  Treasury 
has  leveled  sanctions.49 

88.  On  November  3,  2015,  Sater  explained  to  Trump’s  personal  attorney,  Michael 

Cohen,  how  this  project  would  promote  Trump’s  presidential  aspirations: 

Michael  I  arranged  for  Ivanka  to  sit  in  Putins  private  chair  at  his 
desk  and  office  in  the  Kremlin.  I  will  get  Putin  on  this  program  and 
we  will  get  Donald  elected.  We  both  know  no  one  else  knows  how 
to  pull  this  off  without  stupidity  or  greed  getting  in  the  way.  I  know 
how  to  play  it  and  we  will  get  this  done.  Buddy  our  boy  can  become 
President  of  the  USA  and  we  can  engineer  it.  I  will  get  all  of  Putins 
team  to  buy  in  on  this,  I  will  manage  this  process.50 
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D.  The  Trump  Campaign  Establishes  Further  Ties  To  Russia  And  Russian 
Intelligence  Agents 

89.  From  the  winter  of  20 1 6  through  the  2016  presidential  election,  high-level  and  other 
advisers  to  the  Trump  Campaign,  including  Manafort,  Gates,  Kushner,  Papadopoulos,  and  others, 
were  in  frequent  contact  with  individuals  connected  to  Russian  intelligence  and  the  Russian 
government.51 

90.  For  example,  in  February  2016,  Flynn  began  serving  as  an  informal  foreign  policy 
advisor  to  the  Trump  Campaign.  Flynn  had  ties  to  both  the  GRU  and  Putin.  In  2013,  when  Flynn 
was  serving  as  the  head  of  the  Defense  Intelligence  Agency,  he  was  the  first  U.S.  officer  who  was 
ever  allowed  inside  GRU  headquarters.52  While  he  was  there,  he  lectured  GRU  officers  about 
leadership.  When  he  returned  to  the  United  States,  he  wanted  to  make  a  second  visit  to  the  GRU, 
but  he  could  not  get  permission  from  the  relevant  authorities.  Moreover,  on  December  10,  2015, 
just  a  few  months  before  he  joined  the  Trump  Campaign,  Flynn  was  paid  by  the  Russian 
government-funded  propaganda  outlet  RT  to  attend  and  speak  at  its  anniversary  gala  in  Moscow, 
where  he  dined  next  to  Putin.53 

91.  In  March  2016,  the  Trump  Campaign  also  hired  Manafort.  As  noted  above, 
Manafort  was  millions  of  dollars  in  debt  to  Deripaska  at  the  time.  He  was  also  broke.54  Yet  he 
agreed  to  work  for  the  Trump  Campaign  for  free.  A  few  days  after  he  joined  the  Trump  Campaign, 
Manafort  emailed  Kilimnik  to  discuss  how  they  could  use  Manafort’ s  “media  coverage”  to  settle 
his  debt  with  Deripaska.55 

92.  In  or  around  March  2016,  Papadopoulos  was  also  notified  that  he  would  become  a 
foreign  policy  adviser  to  the  Trump  Campaign,  and  that  a  principal  foreign  policy  focus  of  the 
Trump  Campaign  was  an  improved  relationship  with  Russia.56  On  March  21,  2016,  Trump 


24 


Case  l:18-cv-03501-JGK  Document  182  Filed  10/03/18  Page  29  of  87 


announced  that  Papadopoulos  would  be  among  the  first  members  of  the  Trump  Campaign’s 
foreign  policy  team.57 

93.  Thereafter,  Papadopoulos  frequently  communicated  with  a  professor  based  in 
London  named  Joseph  Mifsud.  In  his  guilty  plea,  Papadopoulos,  attested  that  he  “understood  that 
the  professor  had  substantial  connections  to  Russian  government  officials.”58  Further, 
Papadopoulos  admitted  that  he  “repeatedly  sought  to  use  the  professor’s  Russian  connections  in 
an  effort  to  arrange  a  meeting  between  the  campaign  and  Russian  government  officials.”59 

94.  According  to  Papadopoulos’  Statement  of  Offense,  Mifsud  was  initially 
“uninterested”  in  Papadopoulos,  but  “appeared  to  take  great  interest”  when  Papadopoulos  was 
publicly  named  to  Trump’s  foreign  policy  team.  As  a  result: 

(a)  On  March  14,  2016,  Mifsud  met  with  Papadopoulos  in  Italy.60 

(b)  On  March  24, 2016,  Mifsud  met  again  with  Papadopoulos,  this  time  bringing  along 
a  Russian  national  who  was  introduced  as  a  relative  of  Putin.61 

(c)  On  April  18,  2016,  Mifsud  introduced  Papadopoulos  to  an  individual  he  said  had 
connections  to  the  Russian  Ministry  of  Foreign  Affairs.  Papadopoulos  proceeded 
to  have  multiple  Skype  conversations  with  this  individual  in  which  they  discussed 
setting  up  a  meeting  between  Russian  officials  and  the  Trump  campaign.62 

(d)  On  April  26,  2016,  Mifsud  again  met  with  Papadopoulos  in  London.  At  this 
meeting,  Mifsud  told  Papadopoulos  that  the  Russians  had  “thousands  of  emails” 
that  could  harm  Hillary  Clinton’s  presidential  campaign.63  Papadopoulos 
understood  that  Mifsud  had  met  with  Russian  officials  in  Moscow  “immediately 
prior”  to  relaying  this  information.64 

95 .  Mifsud  later  acknowledged  his  contacts  with  Papadopoulos,  stating  that  he  met  with 
him  “three  or  four  times”  and  helped  connect  him  to  “official  and  unofficial  sources.” 

96.  The  Trump  Campaign  was  aware  of,  and  encouraged,  Papadopoulos ’s  meetings 
with  his  Russian  contacts.  After  meeting  with  Mifsud  and  the  Russian  national  on  March  24,  2016, 
Papadopoulos  reported  back  to  the  Trump  Campaign  that  his  conversation  was  “to  arrange  a 
meeting  between  us  and  the  Russian  leadership  to  discuss  U.S. -Russia  ties  under  President 
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Trump.”65  Informed  of  this  meeting,  Trump  campaign  National  Co-Chairman  Sam  Clovis 
responded  that  he  would  “work  it  through  the  campaign”  and  added:  “Great  work.”66 

97.  Papadopoulos  excitedly  emailed  a  Trump  Campaign  official  on  April  27,  2016: 
“Have  some  interesting  messages  coming  in  from  Moscow  about  a  trip  when  the  time  is  right.”  He 
also  emailed  Trump  Campaign  Manager  Corey  Lewandowski,  reiterating  Russia’s  interest  in 
hosting  Trump.  In  May  2016,  Papadopoulos  sent  Manafort  an  email  stating  that  “Russia  has  been 
eager  to  meet  Mr.  Trump  for  quite  some  time  and  have  been  reaching  out  to  me  to  discuss.” 
Manafort  forwarded  the  email  to  Gates,  writing:  “Lets  discuss.  We  need  someone  to  communicate 
that  DT  is  not  doing  these  trips,”  referring  to  Trump,  and  added  “[i]t  should  be  someone  low  level 
in  the  campaign  so  as  not  to  send  any  signal.”67 

98.  Also  on  April  27,  2016 — the  day  after  Papadopoulos ’s  fourth  meeting  with 
Mifsud — Trump  gave  his  first  major  foreign  policy  address,  where  he  said:  “I  believe  an  easing  of 
tensions,  and  improved  relations  with  Russia  from  a  position  of  strength  only  is  possible, 
absolutely  possible.  Common  sense  says  this  cycle,  this  horrible  cycle  of  hostility  must  end  and 
ideally  will  end  soon.”68  That  evening,  Papadopoulos  flagged  the  speech  for  one  of  his  Russian 
contacts,  and  explained:  “That’s  the  signal  to  meet.”69 

99.  In  May  2016,  Papadopoulos  confided  to  an  Australian  diplomat  that  Russia  had 
politically  damaging  information  on  Secretary  Clinton,  and  the  diplomat  reported  this  to  U.S. 
authorities.70  This  report  prompted  the  FBI  to  launch  its  counterintelligence  investigation  into 
contacts  between  Russia  and  the  Trump  campaign.71 

1 00.  Over  the  next  three  months,  Papadopoulos  continued  to  have  communications  with 
Russian  nationals,  and  continued  to  report  those  communications  to  Trump  Campaign  officials, 
who  encouraged  him  to  set  up  an  off-the-record  meeting  with  Russian  officials  on  behalf  of  the 
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campaign.72  Papadopoulos  later  pleaded  guilty  to  lying  about  these  communications  with  Russian 
nationals.73 

E.  Russia  Steals  A  Massive  Trove  Of  Documents  From  The  DNC 

101.  On  April  18,201 6 — the  date  of  Papadopoulos ’s  third  meeting  with  Mifsud — Russia 
launched  a  pervasive  cyberattack  on  DNC  servers  located  in  Virginia  and  Washington,  D.C.  This 
attack  was  carried  out  by  the  GRU,  with  the  help  of  the  GRU  Operatives.  Upon  information  and 
belief,  the  GRU  operatives  were  carrying  out  military  orders  that  they  could  not  disobey.  The 
attackers  targeted  the  DNC’s  research  department,  document  repositories,  information  technology 
department,  and  other  departments.74 

102.  During  that  time,  the  DNC  worked  to  keep  the  valuable  and  sensitive  data  on  its 
servers  secret  by,  among  other  things,  employing  a  firewall  to  limit  access  to  its  computers  and 
requiring  two-factor  authentication  for  users  who  attempted  to  access  the  servers  from  remote 
locations.  In  addition,  the  DNC  periodically  monitored  its  user  accounts  and  imposed  password 
requirements  concerning  passwords’  age,  length,  and  complexity. 

103.  Nevertheless,  the  GRU  breached  the  DNC’s  cyberdefenses  and,  with  the  help  of 
the  GRU  Operatives,  placed  malware  on  the  DNC  network,  including  proprietary  malware  known 
as  “X-Agent.”  The  GRU  Operatives  monitored  this  malware  and  collected  data  from  DNC 
computers,  including  key  logs  and  screenshots.75 

104.  On  April  22,  2016,  the  GRU  staged  several  gigabytes  of  DNC  data  located  on  the 
DNC’s  servers  for  unauthorized  and  surreptitious  exfiltration  (i.e.,  theft).  The  GRU  then  used 
malware  known  as  “X-Tunnel”  to  exfiltrate  this  stolen  DNC  data  to  a  GRU-leased  computer 
located  in  Illinois.76 

105.  Between  April  and  June  of  2016,  the  GRU  gained  access  to  at  least  33  DNC 
computers  and  the  DNC’s  email  server.  By  June  2016,  Russia  had  stolen  thousands  of  emails  and 
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documents  containing  sensitive  data  from  the  DNC,  including  donor  information,  financial  and 
economic  information,  opposition  research,  information  regarding  planned  political  activities,  and 
thousands  of  private  confidential  emails. 

1 06.  Some  of  the  stolen  documents  were  compilations  of  public  and  private  information 
which  derived  substantial  value  from  their  amalgamation  and  organization.  The  documents  derived 
economic  value  from  the  fact  of  their  secrecy:  if  the  data  they  contained  were  made  public,  it  would 
reveal  critical  insights  into  the  DNC’s  political,  financial,  and  voter  engagement  strategies. 

1 07.  The  DNC  used  this  data  in  interstate  commerce  by,  among  other  things,  fundraising 
and  organizing  events. 

108.  The  GRU  could  have  derived  significant  economic  value  from  the  theft  of  the 
DNC’s  data  by,  among  other  possibilities,  selling  the  data  to  the  highest  bidder. 

F.  The  DNC  Discovers  The  Hack  And  Hires  CrowdStrike 

109.  On  April  28,  2016,  DNC’s  information  technology  department  detected 
unauthorized  users  in  the  DNC’s  computer  network. 

110.  Upon  discovering  the  intrusion,  the  DNC  contacted  CrowdStrike  Services,  Inc. 
(“CrowdStrike”),  a  cybersecurity  technology  firm,  to  investigate  the  attack,  assess  the  damage 
done  to  the  DNC’s  computers  and  servers,  and  assist  the  DNC  in  its  remediation  efforts. 

111.  CrowdStrike  performed  a  forensic  analysis  of  the  DNC’s  computer  network  and 

servers. 

1 12.  CrowdStrike  also  set  up  a  system  for  monitoring  the  ongoing  attack  on  Plaintiffs’ 
computer  system  and  to  alert  the  DNC  to  future  attacks. 

113.  In  order  to  remove  the  unauthorized  users  from  its  network,  the  DNC  had  to 
decommission  more  than  140  servers,  remove  and  reinstall  all  software,  including  the  operating 
systems,  for  more  than  180  computers,  and  rebuild  at  least  1 1  servers. 
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G.  Forensic  Evidence  Confirms  Russia’s  Attack  On  The  DNC’s  Network 

114.  Both  CrowdStrike’s  forensic  analysis  and  the  U.S.  Government  concluded  that  the 
DNC’s  computer  systems  had  been  hacked  by  two  independent,  sophisticated  Russian  state- 
sponsored  adversaries,  both  with  a  nexus  to  Russia’s  intelligence  services.77  The  forensic  analysts 
tracked  the  hacking  activities  of  these  adversaries  by  assigning  them  code  names:  “Cozy  Bear” 
and  “Fancy  Bear,”  which  correspond  to  the  more  widely  used  names  Advanced  Persistent  Threat 
29  (APT  29)  and  Advanced  Persistent  Threat  28  (APT  28),  respectively.78 

115.  Forensic  analysis  found  evidence  that  Cozy  Bear  had  infiltrated  and  remained 
present  in  the  DNC’s  network  since  at  least  July  27,  2015. 79  The  IC  Report  similarly  concluded 
that  Russian  intelligence  first  gained  access  to  the  DNC  network  in  July  2015.  CrowdStrike  also 
determined  that  Cozy  Bear  used  the  stolen  credentials  of  user  accounts  to  access  the  DNC’s 
computer  systems.80 

116.  CrowdStrike  determined  that  the  objective  of  the  Cozy  Bear  actor  was  to  access 
and  collect  information  from  DNC  systems  that  were  primarily  used  for  communications.  The 
analysis  identified  Cozy  Bear  malware  in  DNC  systems  providing  email,  email  support,  backup 
servers,  voiceover  internet  protocol,  and  chat.81 

117.  The  U.S.  Government  concluded  that  Cozy  Bear  was  an  operative  of  or  associated 
with  Russian  intelligence.82 

118.  The  DNC  first  detected  “Fancy  Bear”  in  its  network  on  April  28,  2016. 83  The  IC 
Report  concluded  that  “Fancy  Bear”  was  acting  as  an  agent  of  the  GRU.  In  July  2018,  the  U.S. 
Department  of  Justice  announced  the  indictment  of  the  GRU  Operatives  for  executing  cyberattacks 
on  the  DNC  in  2016  and  disseminating  stolen  DNC  data  through  WikiLeaks  and  the  GRU-created 
online  persona  Guccifer  2.0. 84 
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119.  CrowdStrike  determined  that  the  GRU’ s  obj ective  was  to  collect  information  about 
the  DNC’s  political  and  research  activities.85 

120.  According  to  the  U.S.  government,  the  GRU  intentionally  deleted  logs  and 
computer  files  to  cover  their  tracks  while  they  maintained  an  authorized  presence  within  the  DNC 
network  and  stole  DNC  data.86 

121.  On  April  22,  2016,  the  GRU  staged  for  exfiltration  several  gigabytes  of  data  that 
included  opposition  research  on  Donald  Trump.  According  to  the  U.S.  government,  the  GRU  later 
used  proprietary  malware  known  as  “X-Tunnel”  to  move  this  data  outside  of  the  DNC  network 
through  encrypted  channels  to  a  GRU-leased  computer  in  Illinois.  On  or  about  April  28,  2016,  the 
GRU  connected  to  and  tested  the  same  computer  located  in  Illinois.87 

122.  According  to  the  U.S.  government,  while  hacking  the  DNC  networks,  the  GRU 
covered  its  tracks  by  intentionally  deleting  logs  and  computer  files.  For  example,  on  or  about  May 
13,  2016,  the  GRU  cleared  the  event  logs  from  a  DNC  computer.88 

123.  Between  May  25  and  June  1,  2016,  the  GRU  hacked  into  the  DNC’s  email  server 
and  stole  thousands  of  emails  from  the  accounts  of  DNC  employees.89 

124.  According  to  the  U.S.  government,  the  GRU  exfiltrated  DNC  documents,  and  GRU 
operatives  posted  some  of  those  documents  publicly  online.90 

125.  According  to  an  analysis  of  metadata,  documents  that  originally  resided  on  DNC 
servers  were  published  without  permission  on  a  website,  found  at  www.guccifer2.wordpress.com, 
by  GRU  operatives. 

126.  According  to  the  U.S.  government,  the  GRU  transmitted  stolen  emails  to 
WikiLeaks  between  July  14, 2016  and  July  18,  2016  after  WikiLeaks  requested  stolen  information 
from  the  DNC  that  it  could  use  to  harm  the  Democratic  party.91 
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127.  Forensic  analysis  shows  that  both  Cozy  Bear  and  Fancy  Bear  used  the  stolen 
credentials  of  user  accounts  to  access  the  DNC’s  computer  systems. 92 

128.  In  addition,  forensic  analysis  showed  that  the  hackers  accessed  the  DNC’s  Voice¬ 
over  Internet  Protocol  (“VOIP”)  transfers,  permitting  them  to  monitor  voice-based 
communications,  such  as  phone  calls  and  voicemail. 

129.  On  information  and  belief,  the  hackers  intercepted  or  endeavored  to  intercept 
emails  and  voice-based  communications  while  in  the  DNC  servers. 

130.  To  carry  out  their  operations,  the  Russian  hackers — including  the  GRU 
Operatives — purchased  servers  in  the  United  States,  registered  several  domain  names,  and  made 
multiple  “payments  in  furtherance  of  hacking  activity.”93 

H.  Russians  Offer  To  Assist  Trump — And  Trump  Associates  Accept  The  Offer 

131.  Trump  clinched  the  Republican  presidential  nomination  on  May  26,  20 1 6.  A  week 
later,  Defendants  launched  a  scheme  to  disseminate  information  that  was  damaging  to  the 
Democratic  party  and  the  DNC. 

132.  On  June  3,  2016,  Aras  and  Emin  Agalarov  made  an  offer  of  assistance  from  the 
Russian  government  to  the  Trump  Campaign: 

Good  morning. 

Emin  [Defendant  Emin  Agalarov]  just  called  and  asked  me  to 
contact  you  with  something  very  interesting. 

The  Crown  prosecutor  of  Russia  met  with  his  father  Aras 
[Defendant  Aras  Agalarov]  this  morning  and  in  their  meeting 
offered  to  provide  the  Trump  campaign  with  some  official 
documents  and  information  that  would  incriminate  Hillary  and  her 
dealings  with  Russia  and  would  be  very  useful  to  your  father. 

This  is  obviously  very  high  level  and  sensitive  information  but  is 
part  of  Russia  and  its  government ’s  support  for  Mr.  Trump  - 
helped  along  by  Aras  and  Emin. 
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(Emphasis  added).  94 

133.  Seventeen  minutes  later,  Trump,  Jr.  responded: 

Thanks  Rob  I  appreciate  that.  I  am  on  the  road  at  the  moment  but 
perhaps  I  [will]  just  speak  to  Emin  first.  Seems  we  have  some  time 
and  if  it ’s  what  you  say  I  love  it  especially  later  in  the  summer. 

(Emphasis  added).  95 

134.  Between  June  6,  2016,  and  June  7,  2016,  Trump  Jr.  and  Emin  Agalarov  exchanged 
several  phone  calls  and  discussed  the  meeting  at  which  Russians  would  provide  the  Trump 
Campaign  with  damaging  information  about  the  Democratic  nominee.96  In  between  two  of  those 
calls,  Trump  Jr.  received  a  call  from  an  unknown  blocked  number.97 

135.  On  June  7,  2016,  shortly  after  the  meeting  between  the  Russians  and  Trump 
Associates  was  set,  Trump  Jr.  emailed:  “Great.  It  will  likely  be  Paul  Manafort  (campaign  boss)  my 
brother  in  law  and  me,  725  Fifth  Ave  25th  floor.”  98  That  night,  Trump  announced  that  he  would 
give  “a  major  speech. . .  discussing  all  of  the  things  that  have  taken  place  with  the  Clintons.”99 

136.  Two  days  later,  on  June  9,  2016,  the  meeting  between  the  Russians  and  Trump 
Associates  took  place.  The  Trump  Campaign  was  represented  by  Trump’s  inner-circle:  Trump,  Jr., 
Kushner,  and  Manafort.  Representing  Russia’s  interests  were  Agalarov  publicist  Rob  Goldstone, 
Kremlin-connected  Russian  lawyer  Natalia  Veselnitskaya  (“Veselnitskaya”),  Agalarov  business 
associate  Irakyl  Kaveladze,  lobbyist  Rinat  Akhmestshin,  and  a  translator. 100 

137.  On  information  and  belief,  Veselnitskaya  was  closely  connected  to  the  Kremlin, 
and  had  a  history  of  acting  as  an  agent  of  the  Russian  government.  In  April  2018,  Veselnitskaya 
called  herself  an  “informant”  for  the  Russian  government  and  admitted  that  she  had  been  “actively 
communicating  with  the  office  of  the  Russian  Prosecutor  General”  since  2013. 101 
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138.  The  day  after  the  Trump  Tower  meeting,  the  Agalarovs  sent  Trump  an  expensive 
painting  as  a  gift  for  his  upcoming  birthday.  In  a  note  to  the  Agalarovs,  Trump  thanked  them  for 
the  gift  and  their  friendship:  “I’m  rarely  at  a  loss  for  words,  but  right  now  I  can  only  say  how  much 
I  appreciate  your  friendship  and  to  thank  you  for  this  fantastic  gift. .  .This  is  one  birthday  that  I  will 
always  remember.”102 

139.  Trump  and  Trump,  Jr.  would  later  go  to  great  lengths  to  conceal  the  meeting  and 
its  content.  For  months,  Trump,  Jr.  and  others  familiar  with  the  June  2016  meeting  denied  that  they 
had  contacts  with  Russians  during  the  campaign.  For  example,  in  March  2017,  when  asked  whether 
he  had  held  any  meetings  with  Russians  related  to  the  presidential  campaign,  Trump,  Jr.  falsely 
stated:  “Certainly  none  that  I  was  representing  the  campaign  in  any  way,  shape  or  form.” 103  Months 
later,  in  July  2017,  when  confronted  with  limited  information  about  the  June  2016  meeting,  Trump, 
Jr.  released  a  series  of  false  statements  that  mischaracterized  and  omitted  key  facts  about  the  June 
2016  meeting  and  the  email  exchange  that  led  to  it,  including  the  Russians’  offer  of  damaging 
information  about  the  Democratic  presidential  nominee  and  the  fact  that  the  email  exchange 
explicitly  informed  Trump,  Jr.  that  the  Russian  government  was  seeking  to  help  the  Trump 
Campaign.  According  to  news  reports,  Trump  helped  craft  the  first  of  these  misleading  statements 
after  rejecting  an  initial  attempt  to  fully  disclose  the  nature  of  the  June  2016  meeting. 104 

I.  Following  The  Trump  Tower  Meeting,  Russia  Continues  Its  Hacking  And 
Launches  A  Massive  Public  Dissemination  Of  Stolen  DNC  Documents 

140.  The  day  after  the  Trump  T ower  meeting,  GRU  agents  placed  a  Linux-based  version 
of  the  GRU’s  X-Agent  malware,  programmed  to  communicate  with  the  GRU-registered  domain 
linuxkml.net,105  onto  a  DNC  backup  server  nicknamed  “Raider.”  Raider  was  located  in  Virginia, 
and  served  the  purpose  of  backing  up  other  DNC  servers. 
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141 .  The  DNC  discovered  the  GRU’s  X-Agent  malware  on  its  Raider  backup  server  on 
October  21,  2016,  when  it  detected  Raider’s  attempts  to  contact  the  GRU-registered  domain 
1inuxkm1.net.  CrowdStrike  performed  a  forensic  analysis  of  Raider  and  confirmed  that  a  Linux- 
based  version  of  X-Agent,  programmed  to  communicate  with  the  GRU,  was  placed  on  Raider  on 
June  10,2016.  Upon  information  and  belief,  the  GRU  was  unable  to  exfiltrate  any  data  from  Raider 
because,  a  few  hours  after  it  placed  malware  on  Raider,  the  DNC  implemented  a  firewall  rule  that 
prevented  the  server  from  communicating  with  computers  outside  of  the  DNC  network  as  part  of 
its  effort  to  limit  the  damage  that  GRU  officers  did  to  the  DNC’s  computer  network.  However, 
later  GRU  cyberattacks  (described  in  detail  below)  were  more  successful. 

142.  On  June  12,  2016,  Assange  appeared  on  a  British  television  show  and  said  that 
WikiLeaks  would  soon  leak  materials  concerning  the  Democratic  presidential  candidate,  adding 
“WikiLeaks  has  a  very  big  year  ahead.”106 

143.  Two  days  after  this  ominous  pronouncement,  the  DNC  publicly  announced  that  its 
systems  had  been  hacked  by  Russian  intelligence  agencies;  this  was  the  first  public  statement  that 
the  Russians  were  interfering  in  the  2016  election.107 

144.  On  June  15,  2016,  GRU  agents,  including  Osadchuk  and  Potemkin,  began  using 
their  online  persona  Guccifer  2.0  to  disseminate  stolen  DNC  material,  both  through  a  GRU- 
operated  website  and  through  WikiLeaks. 108 

145.  The  strategic  dissemination  of  DNC  documents  by  the  GRU  continued  unabated 
through  June  and  early  July  2016,  including: 

(a)  On  June  1 5,  20 1 6,  the  GRU  posted  a  pdf  of  a  DNC-authored  opposition  research 
report  on  Trump  from  December  2015. 109 

(b)  On  June  21,  2016,  GRU  operatives  using  the  screenname  Guccifer  2.0  released  a 
batch  of  stolen  DNC  documents  about  Secretary  Clinton,  one  day  after  Trump 
fired  Corey  Lewandowski  on  June  20. 110 
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(c)  On  June  30,  2016,  GRU  operatives  using  the  screenname  Guccifer  2.0  released 
stolen  DNC  documents  to  the  public,  including  research  on  Republican  candidates 
and  Secretary  Clinton. 1 1 1 

(d)  On  July  6,  2016,  GRU  operatives  using  the  screenname  Guccifer  2.0  released 
stolen  DNC  documents,  including  confidential  DNC  strategy  documents  related  to 
the  DNC’s  “counter-convention”  to  the  RNC  convention. 112  This  was  one  day 
after  FBI  Director  James  Comey  announced  that  no  criminal  charges  would  be 
brought  against  Secretary  Clinton  for  maintaining  a  private  email  server  during 
her  time  at  the  State  Department.113 

J.  WikiLeaks  And  Russian  Intelligence  Discuss  A  Plan  To  Use  Stolen  DNC 
Documents  To  Disrupt  The  Democratic  National  Convention 

146.  On  June  22,  2016,  WikiLeaks  contacted  GRU  operatives  using  the  screenname 
Guccifer  2.0  to  request  new  material  stolen  from  the  DNC.  In  subsequent  exchanges,  WikiLeaks 
stated  that  Trump  had  a  “25  percent  chance”  of  defeating  the  Democratic  presidential  nominee  and 
suggested  that  his  odds  might  improve  if  WikiLeaks  could  disseminate  stolen  documents  that 
would  create  conflict  among  Democrats  during  the  upcoming  Democratic  National  Convention.114 

147.  In  a  private  message,  WikiLeaks  asked  for  Guccifer  2.0  to  “[s]end  any  new  material 
[stolen  from  the  DNC]  here  for  us  to  review  and  it  will  have  a  much  higher  impact  than  what  you 
are  doing.”115 

148.  On  July  6,  2016,  WikiLeaks  contacted  Guccifer  2.0  asking  for  stolen  information 
that  would  boost  Trump’s  chances  of  victory  by  sowing  discord  at  the  Democratic  National 
Convention  and  harming  the  Democratic  presidential  nominee.  In  a  private  message  to  Guccifer 
2.0,  WikiLeaks  asked  “if  you  have  anything  hillary  related  we  want  it  in  the  next  tweo  days 
prefable  because  the  DNC  [Democratic  National  Convention]”  is  approaching  and  she  will  solidify 
bernie  supporters  behind  her  after.”  Guccifer  2.0  responded,  “ok. .  .1  see.”  WikiLeaks  explained  its 
strategy  to  help  Trump  and  harm  the  Democratic  nominee  and  party  in  another  message  to  Guccifer 


35 


Case  l:18-cv-03501-JGK  Document  182  Filed  10/03/18  Page  40  of  87 


2.0:  “we  think  trump  has  only  a  25%  chance  of  winning  against  hillary. .  .so  conflict  between  bemie 
and  hillary  is  interesting.”116 

K.  The  Trump  Campaign  Continues  Communicating  With  Russian  Agents  And 
Blocks  Anti-Russian  Language  From  Being  Added  To  The  GOP  Platform  As 
WikiLeaks  And  The  GRU  Finalize  Arrangement  To  Disrupt  The  Democratic 
National  Convention 

149.  In  early  July,  2016,  Manafort — then  chairman  of  the  Trump  Campaign — emailed 
Kilimnik,  his  longtime  aide  with  ties  to  the  GRU,  offering  private  briefings  on  the  presidential 
campaign  to  Russian  oligarch  and  Putin  ally  Deripaska. 

150.  Between  July  11,  2016  and  July  15,  2016,  members  of  the  Trump  campaign 
intervened  to  prevent  the  Republican  National  Committee’s  foreign  policy  platform  committee 
from  amending  the  draft  platform  to  include  a  call  for  the  United  States  to  provide  lethal  arms  to 
Ukraine  to  help  defend  itself  against  Russia.  The  Trump  campaign  succeeded  in  this  effort, 
watering  down  the  proposed  amendment  to  support  only  “appropriate  assistance”  to  Ukraine. 

151.  As  Trump  campaign  officials  worked  to  block  the  anti-Russia  language  from  the 
GOP  platform,  WikiLeaks  and  the  GRU  were  finalizing  an  arrangement  to  release  stolen  DNC 
data  to  disrupt  the  Democratic  National  Convention.  On  July  14,  2016,  Guccifer  2.0  sent 
WikiLeaks  an  email  with  instructions  on  how  to  access  stolen  DNC  documents  in  an  online 
repository.  On  July  18,  2016,  WikiLeaks  confirmed  that  it  had  retrieved  the  “lgb  or  so  archive”  of 
stolen  DNC  documents  and  would  release  them  “this  week,”  which  would  coincide  with  the 
beginning  of  the  Democratic  National  Convention.117 

152.  After  the  convention,  Kilimnik  reportedly  told  associates  that  he  had  played  a  role 
in  the  Trump  campaign’s  success  at  watering  down  the  Ukraine  amendment. 
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L.  After  The  Trump  Campaign  Blocks  Anti-Russia  Language  From  The  GOP 
Platform,  WikiLeaks  Begins  Disseminating  Stolen  DNC  Documents 

153.  On  July  22,  2016,  just  three  days  before  the  Democratic  National  Convention, 
WikiLeaks  released  its  first  major  tranche  of  stolen  DNC  materials,  which  included  more  than 
20,000  emails  and  documents  stolen  by  Russian  intelligence  agents.  These  documents  contained 
names,  addresses,  telephone  numbers,  dates  of  birth,  social  security  numbers,  passport  numbers, 
and  other  identifying  information  of  individuals  who  had  communicated  with  or  donated  to  the 
DNC,  as  well  Excel,  Word,  and  other  types  of  files  containing  the  confidential  work  product  of 
DNC  staff.  The  release  also  included  dozens  of  private  voicemail  messages  to  DNC  employees.118 

154.  In  the  midst  of  the  Democratic  Convention,  Trump  and  the  Trump  Campaign 
openly  celebrated  this  publication  of  stolen  materials,  and  Trump  himself  encouraged  Russia  to 
continue  its  hacking  campaign.  At  a  press  conference  on  July  27,  2016,  after  commenting 
extensively  on  the  materials  that  were  stolen  from  the  DNC  servers,  Trump  called  on  the  Russians 
to  continue  their  hacking:  “Russia,  if  you’re  listening,  I  hope  you’re  able  to  find  the  30,000  emails 
that  are  missing.”  He  then  predicted  great  rewards  would  come  to  Russia  if  that  occurred,  stating, 
“I  think  you  will  probably  be  rewarded  mightily  by  our  press.  Let’s  see  if  that  happens.”  119  That 
same  day,  the  GRU  Operatives  attempted — for  the  first  time — to  hack  email  accounts  used  by 
Secretary  Clinton’s  personal  office. 120 

M.  Trump  Associates  Secretly  Communicate  With  Russian  Agents  And 
WikiLeaks  As  They  Strategically  Release  Stolen  DNC  Documents 

155.  Russia’s  unauthorized  release  of  DNC  documents  continued  until  November  2016, 
with  a  critical  increase  in  the  volume  and  damaging  nature  of  these  releases  as  the  general  election 
season  began. 

156.  From  June  2016  to  October  2016,  the  GRU  systematically  released  documents 
stolen  from  the  DNC  on  a  regular  basis. 121  Many  of  the  disclosures  were  timed  to  divert  attention 
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from  adverse  publicity  about  the  Trump  campaign,  and  to  obscure  positive  news  about  the  Clinton 
campaign  and  DNC  activities — serving  the  common  interests  of  the  Trump  Associates,  Russia, 
and  WikiLeaks. 

157.  Beginning  in  the  spring  of  2016,  Trump’s  longtime  friend  and  political  advisor 
Roger  Stone  revealed  on  multiple  occasions  that  he  was  in  contact  with  Assange  and  WikiLeaks 
as  well  as  Guccifer  2.0  about  information  in  their  possession  that  would  be  damaging  to  the  Clinton 
campaign,  to  prominent  members  of  the  Democratic  Party,  and  to  Clinton  campaign  chairman  John 
Podesta. 122  Many  of  these  reports  from  Stone  occurred  well  before  it  was  publicly  known  that  the 
DNC’s  computer  systems  and  Podesta’s  emails  had  been  hacked  by  the  same  Russian  intelligence 
entities. 123 

158.  On  August  8,  2016,  speaking  to  a  local  Republican  Party  group  in  Florida,  Stone 
predicted  the  future  disclosure  of  hacked  materials:  “I  have  actually  communicated  with  Assange. 
I  believe  the  next  tranche  of  his  documents  pertain  to  the  Clinton  Foundation,  but  there’s  no  telling 
what  the  October  surprise  may  be.”  124 

159.  On  August  12,  2016,  Stone  said  that  he  believed  Assange  had  emails  belonging  to 
Secretary  Clinton.125  That  same  day,  GRU  officers  posing  as  Guccifer  2.0  disseminated  another 
set  of  stolen  documents  -  this  time  containing  personal  information  about  Democratic 
candidates. 126  Shortly  thereafter,  on  August  12,  Guccifer  2.0  sent  a  thank-you  note  to  Stone. 127 

1 60.  Also  on  August  12,201 6,  GRU  officers  posing  as  Guccifer  2.0  released  documents 
stolen  from  other  Democratic  entities,  including  strategy  memos  for  five  House  races  in  Florida. 128 
These  documents  were  released  just  days  before  legislative  primaries  in  the  key  battleground  state 
of  Florida.129 
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161.  On  August  14,  2016,  Stone  began  secretly  communicating  with  GRU  operatives 
posing  as  Guccifer  2.0. 130  On  August  17,  2016,  one  of  these  operatives  tweeted  to  Stone,  “please 
tell  me  if  i  can  help  u  anyhow,  it  would  be  a  great  pleasure  to  me.”131 

162.  Also  in  August  2016,  about  two  weeks  before  Manafort  resigned  admit  reports  of 
improper  payments  for  his  pro-Russia  political  work  in  Ukraine,  Manafort  and  Kilimnik  had  dinner 
in  New  York  City,  during  which  the  two  discussed  Trump’s  presidential  campaign. 132 

163.  After  Manafort  resigned,  Gates  (Manafort’ s  deputy)  continued  communicating 
with  Kilimnik  while  serving  as  a  high-ranking  member  of  the  Trump  campaign.  Gates,  like 
Manafort,  was  aware  that  Kilimnik  was  tied  to  the  GRU. 133 

164.  On  August  21,  2016,  amidst  his  communications  with  Russian  intelligence  and 
Assange,  Stone  prophesized  the  future  dissemination  of  Podesta’s  emails,  tweeting:  “Trust  me,  it 
will  soon  [be]  Podesta’s  time  in  the  barrel.”  134  There  had  been  no  public  disclosure  that  Podesta’s 
emails  had  been  hacked  at  that  time. 

165.  In  mid-September  2016,  Stone  accurately  predicted  on  Boston  Herald  Radio  that 
he  expected  “Julian  Assange  and  the  WikiLeaks  people  to  drop  a  payload  of  new  documents  on 
Hillary  on  a  weekly  basis  fairly  soon.”  135 

166.  By  September  20,  2016,  Trump,  Jr.  was  secretly  communicating  with  WikiLeaks 
as  well.  At  one  point,  WikiLeaks  provided  Trump,  Jr.  with  a  password  to  an  anti-Trump  political 
action  committee  website,  which  Trump.  Jr.  later  used.136  In  exchange,  WikiLeaks  asked  Trump, 
Jr.  to  have  his  father  retweet  a  link  to  a  WikiLeaks  website  containing  stolen  Democratic 
documents. 137  Fifteen  minutes  after  WikiLeaks  sent  this  request,  Trump  in  fact  tweeted  “Very  little 
pick-up  by  the  dishonest  media  of  incredible  information  provided  by  WikiLeaks.  So  dishonest! 
Rigged  system!”138 
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167.  On  October  1,  2016,  Stone  stated  on  Twitter:  “Wednesday  @HillaryClinton  is 
done.  #WikiLeaks.”  139  And  on  October  3, 2016,  Stone  reiterated  that  he  was  confident  WikiLeaks 
would  continue  disseminating  hacked  materials:  “I  have  total  confidence  that  @wikileaks  and  my 
hero  Julian  Assange  will  educate  the  American  people  soon.”140 

168.  Four  days  later,  on  October  7,  2016 — and  just  one  hour  after  the  release  of  the 
infamous  Access  Hollywood  recording  in  which  Trump  admitted  to  sexually  assaulting  women — 
WikiLeaks  released  2,000  emails  stolen  from  Podesta.141  WikiLeaks  continued  to  release 
documents  stolen  from  Podesta  on  a  near-daily  basis  until  November  9,  2017  -  just  as  Stone  had 
predicted. 142 

N.  The  GRU  Reaches  Out  To  Stone  About  Democratic  Party  Turnout  Models 

169.  On  August  22,  2016,  GRU  operatives  transmitted  several  gigabytes  of  data  stolen 
from  another  Democratic  party  target  to  a  Republican  party  strategist  in  Florida.  The  data  included 
voter  turnout  analyses  for  Florida  and  other  states. 143 

170.  Between  September  7  and  September  8, 20 1 6,  the  GOP  strategist  exchanged  private 
messages  with  GRU  operatives  posing  as  Guccifer  2.0  in  which  he  explained  the  substantial  value 
of  the  stolen  data  he  had  received  from  them. 144 

171.  On  September  9,  2016,  GRU  operatives  posing  as  Guccifer  2.0  contacted  Stone  to 
ask  him  for  his  reaction  to  the  “turnout  model  for  the  Democrats’  entire  presidential  campaign.” 
Stone  replied,  “[pjretty  standard.”145 

O.  Russia  Launches  Another  Attack  On  DNC  Servers  Housing  Sensitive  And 
Valuable  Trade  Secrets 

172.  On  September  20,  2016,  CrowdStrike’s  monitoring  service  discovered  that 
unauthorized  users — later  discovered  to  be  GRU  officers — had  accessed  the  DNC’s  cloud¬ 
computing  service.  The  cloud-computing  service  housed  test  applications  related  to  the  DNC’s 
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analytics.  The  DNC’s  analytics  are  its  most  important,  valuable,  and  highly  confidential  tools. 
While  the  DNC  did  not  detect  unauthorized  access  to  its  voter  file,  access  to  these  test  applications 
could  have  provided  the  GRU  with  the  ability  to  see  how  the  DNC  was  evaluating  and  processing 
data  critical  to  its  principal  goal  of  winning  elections.  Forensic  analysis  showed  that  the 
unauthorized  users  had  stolen  the  contents  of  these  virtual  servers  by  making  exact  duplicates 
(“snapshots”)  of  them  and  moving  those  snapshots  to  other  accounts  they  owned  on  the  same 
service.  The  GRU  stole  multiple  snapshots  of  these  virtual  servers  between  September  5, 2016  and 
September  22, 2016.  The  U.S.  government  later  concluded  that  this  cyberattack  had  been  executed 
by  the  GRU  as  part  of  its  broader  campaign  to  damage  to  the  Democratic  party. 

173.  In  2016,  the  DNC  used  Amazon  Web  Services  (“AWS”),  an  Amazon-owned 
company  that  provides  cloud  computing  space  for  businesses,  as  its  “data  warehouse”  for  storing 
and  analyzing  almost  all  of  its  data. 

174.  To  store  and  analyze  the  data,  the  DNC  used  a  software  program  called  Vertica, 
which  was  run  on  the  AWS  servers.  Vertica  is  a  Hewlett  Packard  program,  which  the  DNC 
licensed.  The  data  stored  on  Vertica  included  voter  contact  information,  such  as  the  names, 
addresses,  phone  numbers,  and  email  addresses  of  voters,  and  notes  from  the  DNC’s  prior  contacts 
with  these  voters.  The  DNC  also  stored  “digital  information”  on  AWS  servers.  “Digital 
information”  included  data  about  the  DNC’s  online  engagement,  such  as  DNC  email  lists,  the 
number  of  times  internet  users  click  on  DNC  advertisements  (or  “click  rates”),  and  the  number  of 
times  internet  users  click  on  links  embedded  in  DNC  emails  (or  “engagement  rates”).  The  DNC 
also  used  AWS  to  store  volunteer  information — such  as  the  list  of  people  who  have  signed  up  for 
DNC-sponsored  events  and  the  number  of  people  who  attended  those  events. 


41 


Case  l:18-cv-03501-JGK  Document  182  Filed  10/03/18  Page  46  of  87 


175.  Vertica  was  used  to  both  store  DNC  data  and  organize  the  data  so  that  DNC 
computer  engineers  could  access  it.  To  use  the  Vertica  data,  DNC  employees  could  not  simply 
type  a  plain-English  question  into  the  database.  Instead,  DNC  engineers  needed  to  write  lines  of 
computer  code  that  instructed  Vertica  to  search  for  and  display  a  data  set.  The  computer  engineers’ 
coded  requests  for  data  are  called  “queries.” 

176.  When  the  DNC  wanted  to  access  and  use  the  data  it  collected,  the  DNC  described 
the  information  it  wanted  to  retrieve,  and  DNC  computer  engineers  designed  and  coded  the 
appropriate  “queries”  to  produce  that  data.  These  queries  are  secret,  sensitive  work  product 
developed  by  the  DNC  for  the  purpose  of  retrieving  specific  cross-sections  of  information  in  order 
to  develop  political,  financial,  and  voter  engagement  strategies  and  services.  Many  of  these  queries 
are  used  or  intended  for  use  in  interstate  commerce.  The  DNC  derives  value  from  these  queries  by 
virtue  of  their  secrecy:  if  made  public,  these  queries  would  reveal  critical  insights  into  the  DNC’s 
political,  financial,  and  voter  engagement  strategies.  DNC  computer  engineers  could  save  Vertica 
queries  that  they  run  repeatedly.  In  2016,  some  of  the  DNC’s  most  frequently  used  Vertica 
queries — which  revealed  fundamental  elements  of  the  DNC’s  political  and  financial  strategies — 
were  stored  on  the  AWS  servers. 

177.  When  the  DNC  wanted  to  analyze  its  data  to  look  for  helpful  patterns  or  trends,  the 
DNC  used  another  piece  of  software  called  Tableau.  Tableau  is  commercial  software  not 
developed  by  DNC  engineers.  Instead,  the  DNC  purchased  a  license  for  the  Tableau  software,  and 
ran  the  software  against  Vertica. 

178.  Using  Tableau,  the  DNC  was  able  to  develop  graphs,  maps,  and  other  visual  reports 
based  on  the  data  stored  on  Vertica.  When  the  DNC  wanted  to  visualize  the  data  it  collected,  the 
DNC  described  the  information  it  wanted  to  examine,  and  DNC  computer  engineers  designed  and 
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coded  the  appropriate  “Tableau  queries”  to  produce  that  data  in  the  form  requested.  These  Tableau 
queries  are  secret,  sensitive  work  product  developed  by  the  DNC  for  the  purpose  of  transforming 
its  raw  data  into  useful  visualizations.  The  DNC  derives  value  from  these  queries  by  virtue  of  their 
secrecy:  if  made  public,  these  queries  would  reveal  critical  insights  into  the  DNC’s  political, 
financial,  and  voter  engagement  strategies  and  services.  Many  of  these  queries  are  used  or  intended 
for  use  in  interstate  commerce. 

179.  DNC  computer  engineers  could  also  save  Tableau  queries  that  they  ran  repeatedly. 
In  2016,  some  of  the  DNC’s  most  frequently  used  Tableau  queries — which  revealed  fundamental 
elements  of  the  DNC’s  political  and  financial  strategies — were  stored  on  the  AWS  servers. 

180.  The  DNC’s  Vertica  queries  and  Tableau  Queries  that  allow  DNC  staff  to  analyze 
their  data  and  measure  their  progress  toward  their  strategic  goals — collectively,  the  DNC’s 
“analytics,” — are  its  most  important,  valuable,  and  highly  confidential  tools.  Because  these  tools 
were  so  essential,  the  DNC  would  often  test  them  before  they  were  used  broadly. 

181.  The  tests  were  conducted  using  “testing  clusters” — designated  portions  of  the  AWS 
servers  where  the  DNC  tests  new  pieces  of  software,  including  new  Tableau  and  Vertica  Queries. 
To  test  a  new  query,  a  DNC  engineer  could  use  the  query  on  a  “synthetic”  data  set — mock-up  data 
generated  for  the  purpose  of  testing  new  software — or  a  small  set  of  real  data.  For  example,  the 
DNC  might  test  a  Tableau  query  by  applying  the  software  to  a  set  of  information  from  a  specific 
state  or  in  a  specific  age  range.  Thus,  the  testing  clusters  housed  sensitive,  proprietary  pieces  of 
software  under  development.  As  described  above,  the  DNC  derives  significant  value  from  its 
proprietary  software  by  virtue  of  its  secrecy:  if  made  public,  it  would  reveal  critical  insights  into 
the  DNC’s  political,  financial,  and  voter  engagement  strategies  and  services,  many  of  which  are 
used  or  intended  for  use  in  interstate  commerce. 
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182.  The  DNC  protected  all  of  the  data  and  code  in  its  AWS  servers  by,  among  other 
things,  restricting  access  to  authorized  users.  To  gain  access  to  the  AWS  servers  themselves,  an 
authorized  user  had  to  take  multiple  steps.  First,  the  authorized  user  would  have  to  log  onto  a 
Virtual  Private  Network  (VPN)  using  a  unique  username  and  password.  Second,  once  the  user 
entered  a  valid  and  password,  the  system  would  send  a  unique  six-digit  code  (PIN)  to  the 
authorized  user’s  phone,  and  the  user  would  have  30  seconds  to  type  it  into  the  computer  system. 
This  two-step  process  is  commonly  known  as  “two-factor  authentication.” 

183.  Authorized  users  would  also  employ  a  two-factor  authentication  system  to  access 
Tableau  visualizations.  First,  they  would  log  into  a  Google  account  with  a  unique  username  and 
password,  and  then  they  would  enter  a  pin  sent  to  their  cell  phones. 

184.  Finally,  the  DNC’s  AWS  servers  were  protected  with  firewalls  and  cybersecurity 
best  practices,  including:  (a)  limiting  the  IP  addresses  and  ports  with  which  users  could  access 
servers;  (b)  auditing  user  account  activities;  and  (c)  monitoring  authentication  and  access  attempts. 

185.  On  September  20,  2016,  CrowdStrike’s  monitoring  service  discovered  that 
unauthorized  users  had  breached  DNC  AWS  servers  that  contained  testing  clusters.  Further 
forensic  analysis  showed  that  the  unauthorized  users  had  stolen  the  contents  of  these  DNC  AWS 
servers  by  taking  snapshots  of  the  virtual  servers,  and  had  moved  those  replicas  to  other  AWS 
accounts  they  controlled.  The  GRU  stole  multiple  snapshots  of  these  servers  between  September 
5, 2016  and  September  22,  2016.  The  U.S.  later  concluded  that  this  cyberattack  had  been  executed 
by  the  GRU  as  part  of  its  broader  campaign  to  damage  to  the  Democratic  party.  The  GRU  could 
have  derived  significant  economic  value  from  the  theft  of  the  DNC’s  data  by,  among  other 
possibilities,  selling  the  data  to  the  highest  bidder. 
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186.  The  software  would  also  be  usable  as  executable  code  by  DNC  opponents,  who 
could  attempt  to  re-create  DNC  data  visualizations  or  derive  DNC  strategy  decisions  by  analyzing 
the  tools  the  DNC  uses  to  analyze  its  data. 

P.  Trump  Publicly  Praises  The  Illegal  Dissemination  Of  The  Stolen  DNC  Data 

187.  Trump  repeatedly  lauded  the  disclosure  of  the  data  stolen  by  the  Russians,  and 
encouraged  the  media  and  voters  to  pay  more  attention  to  the  leaks. 

188.  On  July  24,  2016,  Trump  tweeted,  “The  Democrats  are  in  a  total  meltdown  but  the 
biased  media  will  say  how  great  they  are  doing!  E-mails  say  the  rigged  system  is  alive  &  well!”146 

189.  On  July  24,  2016,  Trump  tweeted,  “If  the  Republican  Convention  had  blown  up 
with  e-mails,  resignation  of  boss  and  the  beat  down  of  a  big  player.  (Bemie),  media  would  go 
wild[.]”147 

190.  On  July  25,  2016,  Trump  tweeted,  “The  new  joke  in  town  is  that  Russia  leaked  the 
disastrous  DNC  e-mails,  which  should  never  have  been  written  (stupid),  because  Putin  likes 
me.”148 

191.  On  October  12,  2016,  Trump  tweeted,  “Very  little  pick-up  by  the  dishonest  media 
of  incredible  information  provided  by  WikiLeaks.  So  dishonest!  Rigged  system!”149 

192.  Similarly,  on  October  3,  2016,  Trump  Jr.  tweeted,  “For  those  who  have  the  time  to 
read  about  all  the  corruption  and  hypocrisy  all  the  @wikileaks  emails  are  right  here: 
wlsearch.tk.”150  The  link  in  the  October  3,  2016  tweet  was  provided  to  Trump  Jr.  by  WikiLeaks 
via  a  private  tweet  to  Trump,  Jr.’s  Twitter  account.151 

193.  At  his  rallies,  Trump  repeatedly  discussed  the  disclosure  of  documents  on 
WikiLeaks,  enthusiastically  directing  attention  to  those  stolen  documents,  as  the  accounts  below 
reflect: 

(a)  October  10,  2016:  Trump  said,  “I  love  WikiLeaks  . .  .”152 
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(b)  October  3 1 :  2016:  Trump  said  that  “WikiLeaks  is  like  a  treasure  trove,”  and  “Did 
you  see  where,  on  Wikileaks,  it  was  announced  that  they  were  paying  protestors 
to  be  violent,  $1,500.” 153 

(c)  November  2,  2016:  Trump  said,  “WikiLeaks  just  came  out  with  a  new  one,”  and 
“[I]t’s  just  been  shown  [by  Wikileaks]  that  [it’s]  a  rigged  system  with  more 
collusion,  possibly  illegal,  between  the  Department  of  Justice,  the  Clinton 
campaign[,]  and  the  State  Department.”154 

(d)  November  4,  2016:  Trump  said,  “Boy,  I  love  reading  those  WikiLeaks.”155 

(e)  November  6,  2016:  Trump  cited  Wikileaks  while  claiming  that  “Clinton  was 
sending  highly  classified  information  through  her  maid.”156 

(f)  November  7,  2016:  Trump,  “They  got  it  all  down  folks,  WikiLeaks.  WikiLeaks.” 

157 

194.  Finally,  on  November  6,  2016 — just  two  days  before  the  election,  and  at  a  critical 
time  for  undecided  voters — WikiLeaks  released  additional  hacked  DNC  emails,  which  it  dubbed 
“DNC  Leak  2.” 158  The  emails  included,  among  other  things,  internal  discussions  regarding  DNC 
strategy  and  communications  efforts.159 

Q.  Trump — And  Russia — Win 

195.  On  November  9,  20 1 6,  Trump  won  the  election  to  become  President  of  the  United 

States. 

196.  In  Moscow,  the  reaction  was  jubilation.  When  the  news  of  Trump’s  victory  broke 
in  the  Duma  (Russia’s  parliament),  legislators  burst  into  applause,  and  the  announcement  by 
Vyacheslav  Nikonov,  a  member  of  the  Foreign  Affairs  Committee,  was  almost  drowned  out  by 
clapping  and  cheering. 160  Nikonov  stated:  “Three  minutes  ago,  Hillary  Clinton  acknowledged  her 
defeat  in  the  US  presidential  elections  and  just  seconds  ago,  Trump  began  his  speech  as  president¬ 
elect.  I  congratulate  you  all  on  this.”161  Defendants’  common  goal  had  been  achieved. 
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VII.  DEFENDANTS’  REPEATED  EFFORTS  TO  COVER  UP  CONTACTS  WITH 

RUSSIANS  EVIDENCE  THEIR  CONSCIOUSNESS  OF  GUILT 

197.  Trump’s  advisers  repeatedly  denied  that  members  of  the  Trump  Campaign  had 
contacts  with  Russians  or  Russian  officials,  and  when  confronted  with  evidence  to  the  contrary, 
issued  false  and  misleading  statements  about  the  nature  of  these  contacts.  For  example: 

(a)  On  July  24,  2016,  Trump,  Jr.  was  asked  about  suggestions  that  the  July  22,  2016 
release  of  stolen  DNC  emails  was  part  of  a  Russian  plot  to  “help  Donald  Trump 
and  hurt  Hillary  Clinton.”  Despite  having  been  informed  via  email  weeks  earlier 
that  there  was  such  a  plot,  Trump,  Jr.  responded:  “Well,  just  goes  to  show  you  their 
exact  moral  compass.  They’ll  say  anything  to  be  able  to  win  this.  This  is  time  and 
time  again,  lie  after  lie... It’s  disgusting;  it’s  so  phony.”162 

(b)  On  July  24,  2016,  just  weeks  after  he  participated  in  the  June  2016  meeting,  Paul 
Manafort  was  asked  whether  there  were  any  “ties  between  Mr.  Trump,  you  and 
your  campaign  and  Putin  and  his  regime.”  Manafort  replied:  “No,  there  are  not. 
That’s  absurd.  And,  you  know,  there’s  no  basis  to  it.”163 

(c)  On  November  11,  2016,  Trump  campaign  spokesperson  Hope  Hicks  provided 
the  Associated  Press  with  a  statement  denying  that  the  Trump  campaign  had  any 
communications  with  any  “foreign  entity”  during  the  campaign:  “Never  happened. 
There  was  no  communication  between  the  campaign  and  any  foreign  entity  during 
the  campaign.”164 

(d)  On  December  18,  2016,  Trump  campaign  manager  Kellyanne  Conway  was  asked 
whether  anyone  involved  in  the  Trump  campaign  had  “any  contact  with  Russians 
trying  to  meddle  with  the  election?”  Conway  responded:  “Absolutely  not.  And  I 
discussed  that  with  the  president-elect  just  last  night.  Those  conversations  never 
happened.  I  hear  people  saying  it  like  it’s  a  fact  on  television.  That  is  just  not  only 
inaccurate  and  false,  but  it’s  dangerous.”165 

(e)  In  March  2017,  Trump,  Jr.  falsely  stated:  “Did  I  meet  with  people  that  were 
Russian?  I’m  sure,  I’m  sure  I  did.  But  none  that  were  set  up.  None  that  I  can  think 
of  at  the  moment.  And  certainly  none  that  I  was  representing  the  campaign  in  any 
way,  shape  or  form.”166 

(f)  On  July  8,  2017,  Trump,  Jr.  released  a  highly  misleading  statement  about  the  June 
2016  meeting  that  was  reportedly  crafted  by  his  father:  “It  was  a  short  introductory 
meeting.  I  asked  Jared  [Kushner]  and  Paul  [Manafort]  to  stop  by.  We  primarily 
discussed  a  program  about  the  adoption  of  Russian  children  that  was  active  and 
popular  with  American  families  years  ago  and  was  since  ended  by  the  Russian 
government,  but  it  was  not  a  campaign  issue  at  the  time  and  there  was  no  follow 
up...”167 
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(g)  On  July  9,2017,  Trump,  Jr.  released  another  highly  misleading  statement  about  the 
June  2016  meeting:  “The  woman  stated  that  she  had  information  that  individuals 
connected  to  Russia  were  funding  the  Democratic  National  Committee  and 
supporting  Mrs.  Clinton.  Her  statements  were  vague,  ambiguous  and  made  no 
sense.  No  details  or  supporting  information  was  provided  or  even  offered.  It  quickly 
became  clear  that  she  had  no  meaningful  information.  She  then  changed  subjects 
and  began  discussing  the  adoption  of  Russian  children  and  mentioned  the 
Magnitsky  Act.  It  became  clear  to  me  that  this  was  the  true  agenda  all  along  and 
that  the  claims  of  potentially  helpful  information  were  a  pretext  for  the  meeting.” 168 

(h)  On  October  5,  2017,  Papadopoulos  pleaded  guilty  to  lying  about  his  contacts  with 
Mifsud  and  other  Russian  contacts  during  interviews  with  the  FBI.  Papadopoulos 
also  deleted  his  Facebook  account,  scrubbed  other  social  media  accounts,  and 
changed  his  cell  phone  number  in  an  attempt  to  hide  those  contacts. 169 

198.  The  Russian  government  has  also  repeatedly  denied  responsibility  for  interference 
in  the  2016  election,  including  the  cyberattacks  on  the  DNC.  Likewise,  WikiLeaks  and  Assange 
have  repeatedly  denied  that  the  stolen  DNC  material  they  disseminated  was  provided  to  them  by 
Russia,  and  have  cast  doubt  on  whether  Russia  was  responsible  for  the  cyberattacks  on  the  DNC. 
VIII.  THE  SIGNIFICANT  HARM  INFLICTED  UPON  PLAINTIFF 

199.  The  illegal  conspiracy  inflicted  profound  damage  upon  the  DNC.  The  timing  and 
selective  release  of  the  stolen  materials  prevented  the  DNC  from  communicating  with  the 
American  electorate  on  its  own  terms.  These  selective  releases  of  stolen  material  reached  a  peak 
immediately  before  the  Democratic  National  Convention  and  continued  through  the  general 
election. 

200.  The  timing  and  selective  release  of  stolen  materials  was  designed  to  and  had  the 
effect  of  driving  a  wedge  between  the  DNC  and  Democratic  voters.  The  release  of  stolen  materials 
also  impaired  the  DNC’s  ability  to  support  Democratic  candidates  in  the  general  election. 

201.  The  public  release  of  stolen  DNC  materials  was  enormously  disruptive  to  the 
Democratic  National  Convention,  undermining  the  party’s  ability  to  achieve  unity  and  rally 
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members  around  their  shared  values.  The  release  cast  a  cloud  over  the  convention’s  activities, 
interfering  with  the  party’s  opportunity  to  communicate  its  vision  to  the  electorate. 

202.  The  release  of  this  stolen  material  upended  the  DNC’s  ability  to  communicate 
effectively  among  staff  and  with  members  of  the  party  and  broader  community.  It  also  exposed 
the  DNC’s  staff  to  constant  threats  by  telephone  and  email,  which  were  unavoidable  because  staff 
could  not  change  their  contact  information  with  the  Convention  underway. 

203.  The  DNC  also  suffered  significant  interruption  and  disruption  of  its  political  and 
fundraising  activities  throughout  the  United  States  during  the  critical  final  months  of  the 
presidential  campaign.  Specifically,  the  release  of  personal,  and  sometimes  embarrassing, 
information  about  DNC  donors  had  a  chilling  effect  on  donations  to  the  DNC,  resulting  in  a 
substantial  loss  of  income  to  the  DNC  and  a  reduction  in  the  overall  amounts  of  funds  that  the 
DNC  could  expend  to  support  Democratic  candidates  nationwide. 

204.  In  addition,  because  the  public  releases  included  personal  and  in  some  cases 
protected  information  about  DNC  employees,  it  exposed  employees  of  the  DNC  to  intense, 
frightening,  and  sometimes  life-threatening  harassment.  Understandably,  this  harassment  impaired 
the  employees’  ability  to  function  effectively  in  their  jobs. 

205.  On  July  22,  2016 — the  same  day  as  the  first  WikiLeaks  release  of  stolen  DNC 
emails — a  DNC  employee  received  a  voicemail  from  an  unknown  caller  stating  that  the  employee 
should  be  “executed”  and  that  he  hoped  the  employee  would  be  “put  in  jail,  put  on  trial,  and 
executed  for  being  [a]  traitor.” 

206.  On  July  23,  2016,  multiple  DNC  employees  received  an  email  stating:  “I  hope  all 
your  children  get  raped  and  murdered.  I  hope  your  family  knows  nothing  but  suffering,  torture  and 
death.” 
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207.  On  July  24,  2016,  an  employee  received  a  voicemail  stating  “you  got  a  target  on 
your  back,  better  keep  looking  over  your  shoulder,  [expletive]. . .  .You  [expletives].  Die,  Die,  Die, 
Die.  I  hate  you  [expletive]  guts,  you  [expletive].  You’ve  got  an  arrow  on  your  back.  And  you  know 
what?  Snipers  are  going  to  get  you.  You  [expletives].” 

208.  Another  received  a  profanity-laden  voicemail  warning  him  that  “We’re  coming  for 
you.”  These  threats  as  well  as  others  all  began  after  July  22,  when  WikiLeaks  released  the  over 
20,000  stolen  DNC  emails  which  contained  the  names,  e-mail  addresses,  and  phone  numbers  of 
the  DNC  employees. 

209.  In  addition,  Defendants’  conduct  caused  enormous  damage  to  the  DNC’s  computer 
systems,  creating  the  need  to:  (a)  repair  and  replace  all  of  the  DNC’s  computer  hardware  and 
software,  telephone  and  telephone  systems,  and  back-up  systems  due  to  damage  from  the  illegal 
hacking  and  related  release  of  such  information;  (b)  retain  staff  and  consultants  to  investigate  the 
hacking;  and  (c)  retain  staff  and  consultants  to  remediate  the  damage  caused  by  the  hacking’s 
impact. 

210.  Additionally,  during  the  September  2016  breach  of  the  DNC’s  servers,  the  GRU 
stole  proprietary  information  concerning  the  ways  in  which  the  DNC  analyzed  its  data,  developed 
its  strategies  and  approached  decisions  in  its  efforts  to  win  the  2016  election. 

211.  The  GRU  also  stole  proprietary  computer  code  that  DNC  computer  engineers  spent 
many  hours  developing.  The  DNC  derived  significant  economic  value  from  keeping  that  computer 
code  secret  until  it  was  taken  by  Russian  agents. 
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CAUSES  OF  ACTION 
COUNT  I 

COMPUTER  FRAUD  AND  ABUSE  ACT  (18  U.S.C.  §  1030(A)) 

(AGAINST  RUSSIA  AND  THE  GRU) 

212.  Plaintiff  realleges  and  incorporates  by  reference  all  prior  paragraphs  of  this 
Complaint  and  paragraphs  in  the  counts  below  as  though  set  forth  fully  herein. 

213.  The  DNC’s  computers  are  involved  in  interstate  and  foreign  commerce  and 
communication,  and  are  protected  computers  under  18  U.S.C.  §  1030(e)(2). 

214.  On  information  and  belief,  Russia  and  the  GRU  knowingly  and  intentionally 
accessed  the  DNC’s  computers  without  authorization  or  in  excess  of  authorization,  and  thereby 
obtained  and  used  valuable  information  from  those  computers  in  violation  of  18  U.S.C.  § 
1030(a)(2)(C).  Such  information  included,  but  was  not  limited  to:  private,  politically  sensitive 
communications  between  the  DNC  and  Democratic  stakeholders  and  candidates;  confidential 
donor  data;  digital  information;  DNC-developed  code;  confidential  campaign  strategy  plans; 
opposition  and  policy  research;  and  documents  regarding  planned  political  events,  including 
fundraisers  and  rallies.  The  information  was  used  to  advance  the  plan  to  denigrate  the  Democratic 
presidential  nominee  and  the  Democratic  party  (discussed  herein)  and  bolster  Trump’s  candidacy 
by  strategically  releasing  the  confidential,  proprietary  information  to  the  public  online,  including 
on  WikiLeaks. 

215.  Upon  information  and  belief,  Russia  and  the  GRU  knowingly  caused  the 
transmission  of  information  or  a  program,  code,  or  command,  and  as  a  result  of  such  conduct, 
intentionally  caused  damage  without  authorization,  to  a  protected  computer,  in  violation  of  18 
U.S.C.  §  1030(a)(5)(A).  Such  transmission  included,  but  was  not  limited  to,  the  use  of  malware  on 
DNC  systems. 
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216.  Upon  information  and  belief,  Russia  and  the  GRU  intentionally  accessed  a 
protected  computer  or  computers  without  authorization,  and  as  a  result  of  such  conduct,  caused 
damage  and  loss,  in  violation  of  18  U.S.C.  §  1030(a)(5)(C),  or  recklessly  caused  damage,  in 
violation  of  18  U.S.C.  §  1030(a)(5)(B). 

217.  Upon  information  and  belief,  Russia  and  the  GRU,  knowingly  and  with  intent  to 
defraud,  trafficked  passwords  and  similar  information  from  the  DNC  systems,  and  such  trafficking 
affected  interstate  or  foreign  commerce  in  violation  of  18  U.S.C.  §  1030(a)(6)(A). 

218.  Russia  and  the  GRU  caused  loss  to  one  or  more  persons  during  a  one-year  period 
aggregating  well  over  $5,000  in  value,  and  they  also  caused  damage  affecting  ten  or  more  protected 
computers  during  a  one-year  period. 

219.  The  DNC  suffered  damage  and  loss  as  a  consequence  of  Russia  and  the  GRU’s 
actions,  including  but  not  limited  to  the  cost  of  investigating  and  responding  to  the  unauthorized 
access  and  abuse  of  their  computer  networks,  conducting  damage  assessments,  restoring  and 
replacing  computers  and  data,  programs,  systems,  or  information,  the  loss  of  the  value  of  the 
DNC’s  trade  secrets,  and  the  harm  to  the  DNC’s  business  as  described  above.  The  DNC  seeks 
compensatory  and  other  equitable  relief  under  18  U.S.C.  §  1030(g). 

COUNT  II 

RICO  (18  U.S.C.  §  1962(C)) 

(AGAINST  ALL  DEFENDANTS) 

220.  Plaintiff  realleges  and  incorporates  by  reference  all  prior  paragraphs  of  this 
Complaint  and  paragraphs  in  the  counts  below  as  though  set  forth  fully  herein. 

221.  Defendants  are  all  “persons”  within  the  meaning  of  18  U.S.C.  §  1961(3).  At  all 
relevant  times,  Defendants  conducted  the  affairs  of  an  Enterprise — which  affected  interstate  and 
foreign  commerce — through  a  pattern  of  racketeering  activity,  in  violation  of  18  U.S.C.  §  1962(c). 
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A.  The  Trump  Campaign  Was  The  Racketeering  Enterprise 

222.  The  Trump  Campaign  was  a  Racketeering  Enterprise,  as  that  term  is  used  in  18 
U.S.C.  §  1961(4).  The  Enterprise  was  formed  by  June  2015. 

223.  The  Trump  Campaign  had  an  ongoing  organizational  framework  for  carrying  out 
its  objectives. 

224.  As  described  above,  each  Defendant — except  the  Trump  Campaign  itself — 
participated  in  the  operation  or  management  of  the  Trump  Campaign. 

225.  Because  the  Trump  Campaign  expended  millions  of  dollars  on  the  2016  presidential 
race,  it  affected  interstate  and  foreign  commerce. 

226.  Each  Defendant — except  the  Trump  Campaign  itself — conducted  and/or 
participated  in  the  affairs  of  the  Trump  Campaign  through  a  pattern  of  racketeering  activity, 
including  acts  indictable  under  18  U.S.C.  §  1831  (economic  espionage);  and  18  U.S.C.  §  1832 
(theft  of  trade  secrets). 

B.  Alternatively,  And  At  The  Very  Least,  The  Trump  Campaign  Was  Part  Of  An 
Association-In-Fact  Enterprise 

227.  Alternatively,  and  at  the  very  least,  the  Trump  Campaign  was  part  of  an 
Association-In-Fact  Enterprise  comprising  Russia,  the  GRU,  the  GRU  Operatives,  WikiLeaks, 
Assange,  the  Trump  Campaign,  Aras  and  Emin  Agalarov,  Mifsud,  the  Trump  Associates,  the 
Defendants’  employees  and  agents,  and  additional  entities  and  individuals  known  and  unknown. 
The  Association- In-Fact  Enterprise  was  formed  by  March  2016  or,  at  the  very  least,  by  June  2016. 
From  the  date  the  Enterprise  was  formed  until  November  8, 2016,  the  members  of  the  Association- 
In-Fact  Enterprise  worked  together  to  further  their  mutual  goals  of  improving  Trump’s  electoral 
prospects  and  damaging  the  DNC. 
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228.  The  Association-In-Fact  Enterprise  had  an  ongoing  organizational  framework  for 
carrying  out  its  objectives.  In  fact,  the  Association-In-Fact  Enterprise  could  not  have  carried  out 
its  intricate  task  of  sharing  confidential  information  at  the  moments  when  it  would  be  most 
beneficial  to  the  Trump  Campaign  unless  it  had  some  structure  for  making  and  communicating 
group  decisions. 

229.  As  described  above,  each  Defendant  participated  in  the  operation  or  management 
of  the  Association-In-Fact  Enterprise,  and  benefitted  financially  from  the  enterprise. 

230.  Because  the  Association-In-Fact  Enterprise’s  activities  affected  electoral  spending 
in  2016,  as  well  as  the  media  response  to  the  2016  presidential  race,  it  affected  interstate  and 
foreign  commerce. 

C.  RICO  Predicate  Acts 

231.  Each  Defendant  conducted  and/or  participated  in  the  affairs  of  the  Trump 
Campaign  and  the  Association-In-Fact  Enterprise  through  a  pattern  of  racketeering  activity, 
including  acts  indictable  under  18  U.S.C.  §  1831  (economic  espionage);  and  18  U.S.C.  §  1832 
(theft  of  trade  secrets). 

232.  Beginning  on  or  before  April  18,  2016,  Russia  and  the  GRU  repeatedly  attempted 
to  take — and  in  many  instances,  did  take —  trade  secrets  from  the  DNC  without  authorization, 
intending  or  knowing  that  doing  so  would  benefit  Russia,  Russian  instrumentalities,  or  Russian 
agents. 

233.  Russia  and  the  GRU  also  copied,  duplicated,  downloaded,  uploaded,  altered, 
destroyed,  replicated,  transmitted,  delivered,  sent,  communicated,  or  conveyed  Plaintiffs  trade 
secrets,  intending  or  knowing  that  doing  so  would  benefit  the  Russian  government,  Russian 
Instrumentalities  or  Russian  agents,  in  furtherance  of  the  illegal  scheme.  Russia — acting  through 
GRU  operatives  using  the  screenname  Guccifer  2.0 — released  and  transmitted  DNC  trade  secrets 
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without  authorization  on  June  15,  June  20,  June  21,  June  30,  July  6,  September  13,  and  October 
18,  of  2016.  Each  release  constitutes  a  separate  act  of  economic  espionage. 

234.  Beginning  on  or  before  April  18,  2016,  Russia  and  the  GRU  received,  bought,  or 
possessed  DNC  trade  secrets,  knowing  the  same  to  have  been  stolen  or  appropriated,  obtained,  or 
converted  without  authorization,  and  intending  or  knowing  that  doing  so  would  benefit  the  Russian 
Government,  Russian  instrumentalities,  or  Russian  agents. 

235.  Beginning  on  or  before  July  6,  2016,  WikiLeaks  and  Assange  aided,  abetted,  and 
counseled  Russia  and  the  GRU  as  Russia  and  the  GRU  took  the  DNC’s  trade  secrets  without 
authorization.  WikiLeaks  and  Assange  knew  that  this  aiding  and  abetting  would  benefit  the 
Russian  government,  Russian  instrumentalities,  or  Russian  agents. 

236.  WikiLeaks  and  Assange  also  copied,  duplicated,  downloaded,  uploaded,  altered, 
destroyed,  replicated,  transmitted,  delivered,  sent,  communicates,  or  conveyed  Plaintiffs  trade 
secrets  intending  or  knowing  that  doing  so  would  benefit  the  Russian  government,  Russian 
instrumentalities,  or  Russian  agents. 

237.  WikiLeaks  and  Assange  released  and  transmitted  DNC  trade  secrets,  including 
confidential,  proprietary  documents  related  to  campaigns,  fundraising,  and  campaign  strategy,  on 
July  22  and  November  6,  2016.  Each  release  constituted  a  separate  act  of  economic  espionage. 

238.  Beginning  on  or  before  July  22,  2016,  and  continuing  daily  thereafter  through 
November  2016,  WikiLeaks  and  Assange,  received,  bought,  or  possessed  Plaintiffs  trade  secrets, 
knowing  them  to  have  been  stolen  or  appropriated,  obtained,  or  converted  without  authorization, 
and  intending  or  knowing  that  doing  so  would  benefit  the  Russian  government,  Russian 
instrumentalities,  or  Russian  agents. 
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239.  Moreover,  beginning  on  or  before  April  18,  2016,  all  of  the  Defendants  repeatedly 
conspired  with  one  another  to  take  without  authorization,  copy  duplicate  download  upload,  alter, 
destroy,  replicate,  transmit,  deliver,  send,  communicate,  convey  the  DNC’s  trade  secrets,  intending 
or  knowing  that  doing  so  would  benefit  the  Russian  Government,  Russian  instrumentalities,  or 
Russian  agents.  In  addition,  the  defendants  repeatedly  conspired  with  one  another  to  receive,  buy, 
or  possess  the  DNC’s  trade  secrets,  knowing  that  those  trade  secrets  were  appropriated,  obtained, 
or  converted  without  authorization,  and  knowing  or  intending  their  actions  would  benefit  the 
Russian  Government,  Russian  instrumentalities,  or  Russian  agents. 

240.  The  Trump  Campaign  and  the  Trump  Associates  aided  and  abetted  Russia,  the 
GRU,  WikiLeaks,  and  Assange  as  they  committed  economic  espionage  and  theft  of  trade  secrets. 
As  explained  above,  the  Trump  Campaign  and  the  Trump  Associates  counseled  and  encouraged 
Russia,  the  GRU,  WikiLeaks,  and  Assange  to  commit  economic  espionage  and  theft  of  trade 
secrets. 

241.  Defendants  also  committed  the  acts  described  above  with  the  intent  to  convert 
Plaintiffs  trade  secrets,  which  are  related  to  a  product  or  service  used  in  or  intended  for  use  in 
interstate  or  foreign  commerce,  to  the  economic  benefit  of  individuals  or  entities  besides  the 
Plaintiff.  Additionally,  Defendants  also  committed  the  acts  described  above  with  the  intent  to 
injure  Plaintiff. 

D.  RICO  Damages 

242.  Plaintiff  has  been  injured  in  its  business  and  property  by  Defendants’  violation  of 
1 8  U.S.C.  §  1 962(c).  Defendants  caused  enormous  harm  to  Plaintiffs  business,  as  described  above, 
and  to  Plaintiffs  computers  and  servers.  All  of  these  injuries  occurred  within  the  United  States. 
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COUNT  III 

RICO  CONSPIRACY  (18  U.S.C.  §  1962(D)) 

(AGAINST  ALL  DEFENDANTS) 

243.  Plaintiff  realleges  and  incorporates  by  reference  all  prior  paragraphs  of  this 
Complaint  and  paragraphs  in  the  counts  below  as  though  set  forth  fully  herein. 

244.  Defendants  conspired  with  each  other  to  violate  18  U.S.C.  §  1962(c).  Defendants 
knowingly  agreed,  combined,  and  conspired  to  conduct  the  affairs  of  the  Enterprise  or  the 
Association-In-Fact  Enterprise  through  a  cyber-espionage  operation.  Each  Defendant  agreed  that 
the  operation  would  involve  repeated  violations  of  18  U.S.C.  §  1831  (economic  espionage);  and 
18  U.S.C.  §  1832  (theft  of  trade  secrets). 

245.  Defendants’  conspiracy  to  violate  18  U.S.C.  §  1962(c)  violated  §  1962(d). 

246.  Plaintiff  has  been  injured  in  their  business  or  property  by  Defendants’  violation  of 
18  U.S.C.  §  1962(d).  Plaintiff  has  been  injured  in  its  business  and  property  by  Defendants’ 
violation  of  18  U.S.C.  §  1962(c).  Defendants  caused  enormous  harm  to  Plaintiffs  business,  as 
described  above,  and  to  Plaintiffs  computers  and  servers.  All  of  these  injuries  occurred  within  the 
United  States. 

COUNT  IV 

WIRETAP  ACT  (18  U.S.C.  §§  2510-22) 

(AGAINST  WIKILEAKS,  ASSANGE,  THE  TRUMP  CAMPAIGN,  AND  THE  TRUMP 
ASSOCIATES) 

247.  Plaintiff  realleges  and  incorporates  by  reference  all  prior  paragraphs  of  this 
Complaint  and  paragraphs  in  the  counts  below  as  though  set  forth  fully  herein. 

248.  Each  of  the  above-listed  defendants  is  a  “person”  within  the  meaning  of  18  U.S.C. 
§§  2510,  2511. 
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249.  In  violation  of  18  U.S.C.  §  2511(l)(c),  WikiLeaks  and  Assange  willfully  and 
intentionally  disclosed  the  contents  of  Plaintiffs  wire,  oral,  or  electronic  communications, 
knowing  or  having  reason  to  know  that  the  information  was  obtained  through  the  interception  of 
wire,  oral,  or  electronic  communication  in  violation  of  18  U.S.C.  §  251 1. 

250.  In  violation  of  18  U.S.C.  §  251  l(l)(d),  WikiLeaks,  Assange,  the  Trump  Associates, 
and  the  Trump  Campaign  willfully  and  intentionally  used  the  contents  of  wire,  oral,  electronic 
communications,  knowing  or  having  reason  to  know  that  the  information  was  obtained  through 
the  interception  of  a  wire,  oral,  or  electronic  communication  in  violation  of  18  U.S.C.  §  251 1. 

25 1 .  Plaintiff  had  a  justifiable  expectation  that  its  wire,  oral,  or  electronic 
communications  were  not  subject  to  interception. 

252.  Plaintiff  is  a  “person”  whose  wire,  oral,  or  electronic  communications  were 
intercepted  within  the  meaning  of  18  U.S.C.  §  2520. 

253.  As  a  direct  result  of  WikiLeaks,  Assange,  the  Trump  Associates,  and  the  Trump 
Campaign’s  actions,  Plaintiff  suffered  irreparable  harm  to  its  business  and  property  and  is  entitled 
to  an  award  of  the  greater  of  the  actual  damages  suffered  or  the  statutory  damages  and  injunctive 
relief  pursuant  to  18  U.S.C.  §  2520(c).  This  harm  includes,  but  is  not  limited  to,  harm  to  DNC 
computers  and  servers,  harm  to  the  DNC’s  reputation,  loss  in  the  value  of  DNC  trade  secrets  and 
business  information,  and  harm  to  business  as  described  above. 

254.  In  light  of  the  egregious  nature  of  WikiLeaks,  Assange,  the  Trump  Associates,  and 
the  Trump  Campaign’s  violations,  Plaintiff  is  entitled  to  punitive  damages  and  reasonable 
attorneys’  fees  and  costs  pursuant  to  18  U.S.C.  §§  2520(b)(2)  &  (3). 
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COUNT  V 

STORED  COMMUNICATIONS  ACT  (18  U.S.C.  §§  2701-12) 

(AGAINST  RUSSIA  AND  THE  GRU) 

255.  Plaintiff  realleges  and  incorporates  by  reference  all  prior  paragraphs  of  this 
Complaint  and  paragraphs  in  the  counts  below  as  though  set  forth  fully  herein. 

256.  Plaintiff  is  a  “person”  within  the  meaning  of  18  U.S.C.  §§  2510(6)  and  2707(a). 

257.  Russia  and  the  GRU  willfully  and  intentionally  accessed  without  authorization  a 
facility  through  which  an  electronic  communication  service  is  provided,  namely,  the  DNC’s 
computer  systems,  including  their  email  servers,  thereby  obtaining  access  to  wire  or  electronic 
communications  while  they  were  in  electronic  storage  in  such  systems,  in  violation  of  18  U.S.C.  § 
2701(a). 

258.  Asa  result  of  these  willful  and  intentional  violations,  Plaintiff  has  suffered  damages 
and,  as  provided  for  in  18  U.S.C.  §  2707,  seeks  an  award  of  the  greater  of  the  actual  damages 
suffered  or  the  statutory  damages;  punitive  damages;  attorneys’  fees  and  other  costs  of  this  action; 
and  appropriate  equitable  relief. 

COUNT  VI 

DIGITAL  MILLENNIUM  COPYRIGHT  ACT  (17  U.S.C.  §  1201  ET SEQ.) 
(AGAINST  RUSSIA  AND  THE  GRU) 

259.  Plaintiff  realleges  and  incorporates  by  reference  all  prior  paragraphs  of  this 
Complaint  and  paragraphs  in  the  counts  below  as  though  set  forth  fully  herein. 

260.  Plaintiffs  computer  networks  and  fdes  contained  information  subject  to  protection 
under  the  copyright  laws  of  the  United  States,  including  campaign  strategy  documents  and 
opposition  research  that  were  illegally  accessed  without  authorization  by  Russia  and  the  GRU. 
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261 .  Access  to  the  copyrighted  material  contained  on  Plaintiffs  computer  networks  and 
email  was  controlled  by  technological  measures,  including  measures  restricting  remote  access, 
firewalls,  and  measures  restricting  access  to  users  with  valid  credentials  and  passwords. 

262.  In  violation  of  17  U.S.C.  §  1201(a),  Russia  and  the  GRU  circumvented  these 
technological  measures  by  stealing  credentials  from  authorized  users,  conducting  a  “password 
dump”  to  unlawfully  obtain  passwords  to  the  system  controlling  access  to  the  DNC’s  domain,  and 
installing  malware  on  Plaintiffs  computer  systems. 

263.  Russia  and  the  GRU’s  conduct  caused  Plaintiff  significant  damages.  These 
damages  include,  but  are  not  limited  to,  damage  resulting  from  harm  to  DNC  computers  and 
servers,  loss  in  the  value  of  DNC  trade  secrets  and  business  information,  and  harm  to  business  as 
described  above.  Plaintiff  is  entitled  to  the  greater  of  its  actual  damages  or  statutory  damages  as 
provided  by  17  U.S.C.  §  1203,  in  an  amount  to  be  proven  at  trial. 

264.  Plaintiff  is  entitled  to  an  award  of  attorneys’  fees  and  costs  as  provided  by  17  U.S.C. 

§  1203. 

COUNT  VII 

MISAPPROPRIATION  OF  TRADE  SECRETS  UNDER  THE  DEFEND  TRADE 
SECRETS  ACT  (18  U.S.C.  §  1836  ET SEQ.) 

(AGAINST  RUSSIA,  THE  GRU,  WIKILEAKS,  AND  ASSANGE) 

265.  Plaintiff  realleges  and  incorporates  by  reference  all  prior  paragraphs  of  this 
Complaint  and  paragraphs  in  the  counts  below  as  though  set  forth  fully  herein. 

266.  The  documents  and  computer  code  that  Russia  and  the  GRU  stole  from  the  DNC’s 
computer  systems  include  trade  secrets  within  the  meaning  of  18  U.S.C.  §  1839. 

267.  Specifically,  the  DNC  is  in  the  business  of  supporting  Democratic  political 
campaigns,  and  the  stolen  documents  included  Democratic  donor  information,  digital  information, 
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DNC-developed  code,  opposition  research,  and  strategic  information  regarding  planned  political 
activities  that  allow  it  to  effectively  carry  out  its  mission. 

268.  The  DNC  takes  and  has  taken  reasonable  measures  to  keep  such  information  secret. 
In  particular,  the  DNC  maintains  and  maintained  their  information  on  secured  servers  and  uses 
two-factor  authentication  to  ensure  that  only  authorized  users  gain  access  to  their  data  and 
computer  code.  In  addition,  the  DNC  uses  firewalls  and  the  cybersecurity  best  practices  described 
above. 

269.  Plaintiffs  trade  secrets  were  related  to  products  or  services  used  in,  or  intended  for 
use  in,  interstate  or  foreign  commerce. 

270.  Defendants  Russia  and  the  GRU  misappropriated  Plaintiffs  trade  secrets. 
Defendants  Russia  and  the  GRU  acquired  Plaintiffs  trade  secrets  knowing  or  having  reason  to 
know  that  the  trade  secrets  were  acquired  by  improper  means.  Defendants  Russia,  the  GRU, 
WikiLeaks,  and  Assange  disclosed  Plaintiffs  trade  secrets  without  consent,  on  multiple  dates, 
discussed  herein,  knowing  or  having  reason  to  know  that  the  trade  secrets  were  acquired  by 
improper  means.  These  misappropriations  started  before  the  effective  date  of  the  Defend  Trade 
Secrets  Act  (May  1 1,  2016)  and  continued  for  months  after  the  effective  date. 

271.  As  a  direct  consequence  of  Defendants’  misappropriation,  Plaintiff  has  suffered 
damages  for  the  cost  of  materials,  loss  of  goodwill,  and  attorneys’  fees  and  costs.  Plaintiff  is  also 
entitled  to  punitive  damages.  These  damages  include,  but  are  not  limited  to,  damage  resulting  from 
harm  to  DNC  computers  and  servers,  loss  in  the  value  of  DNC  trade  secrets  and  business 
information,  and  harm  to  business  as  described  above. 

272.  Plaintiff  is  also  entitled  to  a  preliminary  and  permanent  injunction  pursuant  to  18 
U.S.C.  §  1836(b)(3). 
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COUNT  VIII 

WASHINGTON  D.C.  UNIFORM  TRADE  SECRETS  ACT 
(D.C.  CODE  ANN.  §§  36-401  -  46-410) 

(AGAINST  ALL  DEFENDANTS) 

273.  Plaintiff  realleges  and  incorporates  by  reference  all  prior  paragraphs  of  this 
Complaint  and  paragraphs  in  the  counts  below  as  though  set  forth  fully  herein. 

274.  The  District  of  Columbia  expressly  empowers  a  party  to  recover  damages  for 
misappropriation  of  a  trade  secret. 

275.  The  documents  and  computer  code  that  Russia  and  the  GRU  exfiltrated  from  the 

DNC’s  computer  systems  include  trade  secrets  under  District  of  Columbia  law,  as  discussed  above, 

and  in  keeping  with  the  definition  of  trade  secrets  under  District  of  Columbia  law: 

information,  including  a  formula,  pattern,  compilation,  program, 
device,  method,  technique,  or  process,  that:  (A)  Derives  actual  or 
potential  independent  economic  value,  from  not  being  generally 
known  to,  and  not  being  readily  ascertainable  by,  proper  means  by 
another  who  can  obtain  economic  value  from  its  disclosure  or  use; 
and  (B)  Is  the  subject  of  reasonable  efforts  to  maintain  its  secrecy. 

D.C.  Code  Ann.  §  36-401(2). 

276.  This  information  derived  an  actual  independent  economic  value  by  remaining 
confidential  and  private,  and  not  being  readily  ascertainable  to  others.  Plaintiff  takes  and  has  taken 
reasonable  measures  to  keep  such  information  secret,  as  discussed  supra  in  Count  VII. 

277.  Each  Defendant  disclosed,  received,  and  used  these  misappropriated  trade  secrets 
without  Plaintiffs  consent,  knowing  or  having  reason  to  know  that  the  trade  secrets  were  acquired 
by  improper  means. 

278.  As  a  direct  consequence  of  Defendants’  misappropriation,  Plaintiff  has  suffered 
damages  for  actual  loss  and  from  Defendants’  unjust  enrichment.  These  damages  include,  but  are 
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not  limited  to,  damage  resulting  from  harm  to  DNC  computers  and  servers,  loss  in  the  value  of 
DNC  trade  secrets  and  business  information,  and  harm  to  business  as  described  above. 

279.  Defendants’  misappropriation  of  Plaintiff  s  trade  secrets  was  willful  and  malicious. 
Accordingly,  Plaintiff  is  entitled  to  exemplary  damages  in  an  amount  up  to  twice  actual  damages 
awarded,  as  well  as  attorneys’  fees  and  costs. 

COUNT  IX 

TRESPASS  (D.C.  COMMON  LAW) 

(AGAINST  RUSSIA  AND  THE  GRU) 

280.  Plaintiff  realleges  and  incorporates  by  reference  all  prior  paragraphs  of  this 
Complaint  and  paragraphs  in  the  counts  below  as  though  set  forth  fully  herein. 

281.  The  DNC  owns  and  operates  private  computers  and  a  private  computer  network. 
This  network  and  the  information  contained  therein  constitutes  the  property  of  Plaintiff. 

282.  On  or  about  July  27,  2015,  Russian  intelligence  agents  hacked  into  the  DNC’s 
computers  and  network,  placed  malware  on  the  computers  and  network,  and  left  the  malware  on 
the  computers  and  network.  On  or  about  April  18,  2016,  GRU  agents  hacked  into  the  DNC’s 
computers  and  network,  placed  malware  on  the  computers  and  network,  and  left  the  malware  there 
until  at  least  June  of  2016.  On  or  about  June  10,  2016,  Russia  placed  malware  on  Raider.  That 
malware  remained  on  Raider  until  at  least  the  fall  of  2016.  In  or  about  September  2016,  the  GRU 
separately  hacked  into  the  DNC’s  cloud  computing  service.  Each  hack  constituted  a  separate  and 
independent  trespass  in  the  District  of  Columbia.  In  addition,  Russia  and  the  GRU’s  acts  of  leaving 
malware  on  the  DNC’s  computers  and  networks  constitute  separate  and  independent  trespasses  in 
the  District  of  Columbia.  The  hacks  and  malware  provided  Russia  and  the  GRU  with  unauthorized 
access  to  Plaintiffs  property  in  its  network.  At  no  point  has  anyone  with  authority  to  do  so 
provided  Defendants  with  authorization  to  access  or  remain  on  Plaintiffs  networks. 
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283.  Russia  and  the  GRU’s  hacks  and  malware  interfered  with  the  DNC’s  possessory 
interests  in  their  network  and  the  information  contained  therein.  By  means  of  trespass  onto 
Plaintiffs  computer  network,  Russia  and  the  GRU  acquired  and  disseminated  confidential  and 
personal  information  that  is  Plaintiffs  property.  Defendants  would  have  been  unable  to  disclose 
this  information  but  for  the  illegal  trespass.  Russia  and  the  GRU  therefore  deprived  Plaintiff  of  its 
possessory  interest  in  maintaining  the  privacy  and  confidentiality  of  its  property.  As  a  result, 
Plaintiff  has  suffered  diminution  in  the  value  of  its  property,  and  is  entitled  to  damages. 

COUNT  X 

CONVERSION  (D.C.  COMMON  LAW) 

(AGAINST  RUSSIA  AND  THE  GRU) 

284.  Plaintiff  realleges  and  incorporates  by  reference  all  prior  paragraphs  of  this 
Complaint  and  paragraphs  in  the  counts  below  as  though  set  forth  fully  herein. 

285.  The  DNC  owns  and  operates  a  private  computer  network,  with  computers  and 
servers  located  in  Washington,  D.C.  and  in  Virginia.  This  network  and  the  information  contained 
therein  constitutes  the  property  of  Plaintiff. 

286.  On  April  22,  2016,  the  GRU  staged  several  gigabytes  of  DNC  data  located  on  the 
DNC’s  servers  for  unauthorized  and  surreptitious  exfiltration — known  more  commonly  as  theft. 
The  GRU  later  used  malware  known  as  “X-Tunnel”  to  exfiltrate  this  stolen  DNC  data  outside  of 
the  DNC  network  through  encrypted  tunnels  to  a  GRU-leased  computer  located  in  Illinois.  That 
exfiltration  constituted  an  unlawful  exercise  of  dominion  or  control  over  the  DNC’s  property,  in 
violation  of  the  DNC’s  property  rights. 

287.  The  GRU  further  exercised  unlawful  dominion  or  control  over  the  DNC’s  property 
when  it  deleted  computer  logs  and  files  to  cover  its  tracks,  in  violation  of  the  DNC’s  property 
rights. 
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288.  As  a  result,  Plaintiff  has  suffered  diminution  in  the  value  of  its  property,  and  is 
entitled  to  damages. 

COUNT  XI 

TRESPASS  TO  CHATTELS  (VIRGINIA  COMMON  LAW) 

(AGAINST  RUSSIA  AND  THE  GRU) 

289.  Plaintiff  realleges  and  incorporates  by  reference  all  prior  paragraphs  of  this 
Complaint  and  paragraphs  in  the  counts  below  as  though  set  forth  fully  herein. 

290.  Plaintiff  the  DNC  owns  and  operates  a  private  computer  network,  with  computers 
and  servers  located  in  Washington,  D.C.  and  in  Virginia.  This  network  and  the  information 
contained  therein  constitutes  the  property  of  Plaintiff. 

291.  On  or  about  July  27,  2015,  Russian  intelligence  agents  hacked  into  the  DNC’s 
computers  and  network,  placed  malware  on  the  computers  and  network,  and  left  the  malware  on 
the  computers  and  network.  On  or  about  April  18,  2016,  GRU  agents  hacked  into  the  DNC’s 
computers  and  network,  placed  malware  on  the  computers  and  network,  and  left  the  malware  there 
until  at  least  June  of  2016.  On  or  about  June  10,  2016,  Russia  placed  malware  on  Raider.  That 
malware  remained  on  Raider  until  at  least  the  fall  of  2016.  In  or  about  September  2016,  the  GRU 
hacked  into  the  DNC’s  cloud  computing  service.  Each  hack  constituted  a  separate  and  independent 
trespass  in  Virginia.  The  hacks  and  malware  provided  Russia  and  the  GRU  with  unauthorized 
access  to  Plaintiffs  property  in  its  network.  At  no  point  has  anyone  with  authority  to  do  so 
provided  Defendants  with  authorization  to  access  or  remain  on  Plaintiffs  networks. 

292.  Russia  and  GRU’s  hacks  and  malware  interfered  with  Plaintiffs  possessory 
interests  in  its  network  and  the  information  contained  therein.  By  means  of  trespass  onto  Plaintiffs 
network,  Russia  and  the  GRU  acquired  and  disseminated  confidential  and  personal  information 
that  is  Plaintiffs  property.  Defendants  would  have  been  unable  to  disclose  this  information  but  for 
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the  illegal  trespass.  Russia  and  the  GRU  therefore  deprived  Plaintiff  of  its  possessory  interest  in 
maintaining  the  privacy  and  confidentiality  of  its  property.  As  a  result,  Plaintiff  has  suffered 
diminution  in  the  value  of  its  property,  and  is  entitled  to  damages. 

COUNT  XII 

CONSPIRACY  TO  COMMIT  TRESPASS  TO  CHATTELS 
(VIRGINIA  COMMON  LAW) 

(AGAINST  ALL  DEFENDANTS) 

293.  Plaintiff  realleges  and  incorporates  by  reference  all  prior  paragraphs  of  this 
Complaint  and  paragraphs  in  the  counts  below  as  though  set  forth  fully  herein. 

294.  Defendants  were  part  of  a  common  scheme  in  which  they  conspired  and  combined 
to  access  without  authorization  the  DNC’s  computer  systems  to  steal  confidential  information, 
publicly  disseminate  the  stolen  information,  and  use  that  stolen  and  publicly  disclosed  information 
for  the  common  purpose  of  denigrating  Secretary  Clinton  and  the  Democratic  Party,  and  bolstering 
Trump’s  electoral  prospects.  These  actions  constituted  an  exercise  of  wrongful  dominion  over 
Plaintiffs  computers  and  computer  system  and  private  email  accounts. 

295.  Pursuant  to,  and  in  furtherance  of,  this  common  scheme,  Defendants  conspired  to 
commit  the  unlawful  acts  described  herein,  including  acts  that  constitute  trespass. 

296.  Pursuant  to,  and  in  furtherance  of,  this  common  scheme,  each  Defendant  committed 
overt  acts,  including  arranging  meetings  between  the  co-conspirators,  encouraging  and  planning 
for  the  scheme  to  occur,  hacking  into  the  DNC’s  computers  and  network,  installing  and  leaving 
malware  on  the  DNC’s  computers  and  network,  stealing  the  DNC’s  private,  confidential 
information,  and  releasing  that  information,  without  permission,  to  the  public.  These  overt  acts 
caused  Plaintiff  injury  and  damages,  as  discussed  supra. 

297.  All  of  the  named  Defendants  aided  and  abetted  in  the  unlawful  acts  described  herein 
as  part  of  and  furtherance  of  a  common  scheme,  and  each  of  these  Defendants  knowingly  and 
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substantially  assisted  the  common  scheme,  and  was  generally  aware  of  his  role  as  part  of  an  overall 
common  scheme.  Accordingly,  the  actions  of  Defendants  constitute  conspiracy  to  trespass. 

298.  As  a  result,  Plaintiff  has  suffered  diminution  in  the  value  of  its  property,  and  is 
entitled  to  damages. 

COUNT  XIII 

CONVERSION  (VIRGINIA  COMMON  LAW) 

(AGAINST  RUSSIA  AND  THE  GRU) 

299.  Plaintiff  realleges  and  incorporates  by  reference  all  prior  paragraphs  of  this 
Complaint  and  paragraphs  in  the  counts  below  as  though  set  forth  fully  herein. 

300.  The  DNC  owns  and  operates  a  private  computer  network,  with  computers  and 
servers  located  in  Washington,  D.C.  and  in  Virginia.  This  network  and  the  information  contained 
therein  constitutes  the  property  of  Plaintiff. 

301.  On  April  22,  2016,  the  GRU  staged  several  gigabytes  of  DNC  data  located  on  the 
DNC’s  servers  for  unauthorized  and  surreptitious  exfiltration — known  more  commonly  as  theft. 
That  same  day,  the  GRU  later  used  malware  known  as  “X-Tunnel”  to  exfiltrate  this  stolen  DNC 
data  outside  of  the  DNC  network  through  encrypted  tunnels  to  a  GRU-leased  computer  located  in 
Illinois.  That  exfiltration  constituted  an  unlawful  exercise  of  dominion  or  control  over  the  DNC’s 
property,  in  violation  of  the  DNC’s  property  rights. 

302.  The  GRU  further  exercised  unlawful  dominion  or  control  over  the  DNC’s  property 
when  it  deleted  computer  logs  and  files  to  cover  its  tracks,  in  violation  of  the  DNC’s  property 
rights. 

303.  As  a  result,  Plaintiff  has  suffered  diminution  in  the  value  of  its  property,  and  is 
entitled  to  damages. 
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COUNT  XIV 

VIOLATION  OF  THE  VIRGINIA  COMPUTER  CRIMES  ACT 
(VA.  CODE  ANN.  §  18.2-152.5  ET  SEQ.) 

(AGAINST  ALL  DEFENDANTS) 

304.  Plaintiff  realleges  and  incorporates  by  reference  all  prior  paragraphs  of  this 
Complaint  and  paragraphs  in  the  counts  below  as  though  set  forth  fully  herein. 

305.  Russia  and  the  GRU  used  Plaintiffs  computers  and  computer  networks  without 
authority,  obtained  property  by  false  pretenses,  and  converted  Plaintiffs  property  in  violation  of 
Va.  Code  Ann.  §  18.2-152.3. 

306.  Russia  and  the  GRU,  with  malicious  intent: 

a.  temporarily  or  permanently  removed,  halted,  or  otherwise  disabled 
computer  data,  computer  programs  or  computer  software  from  the  DNC’s 
computer  or  computer  network,  in  violation  of  Va.  Code  Ann.  §  18.2- 
152.4(1); 

b.  caused  the  DNC’s  computers  to  malfunction,  in  violation  of  Va.  Code  Ann. 
§  18.2-152.4(2); 

c.  altered,  disabled,  or  erased  computer  data,  computer  programs  or  computer 
software,  in  violation  of  Va.  Code  Ann.  §  18.2-152.4(3); 

d.  used  a  computer  or  computer  network  to  make  or  cause  to  be  made  an 
unauthorized  copy  of  computer  data,  computer  programs  or  computer 
software  residing  in,  communicated  by,  or  produced  by  a  computer  or 
computer  network,  in  violation  of  Va.  Code  Ann.  §  18.2-152.4(6); 

e.  placed  or  caused  to  be  placed,  or  collected  information  through,  a  keystroke 
logger  on  the  DNC’s  computers  and,  without  their  authorization,  in 
violation  of  Va.  Code.  Ann.  §  18.2-152.4(8). 
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307.  Defendants  Russia  and  the  GRU  used  a  computer  or  computer  network  and 
intentionally  examined  without  authority  employment,  credit,  financial,  or  identifying  information 
relating  to  other  persons,  in  violation  of  in  Va.  Code.  Ann.  §  18.2-152.5. 

308.  Each  Defendant  knowingly  aided,  abetted,  encouraged,  induced,  instigated, 
contributed  to  and  assisted  Russia  and  the  GRU’s  violation  of  Va.  Code  Ann.  §  18.2-152.3,  §  18.2- 
152.4,  and  §  18.2-152.5. 

309.  All  Defendants’  violations  of  the  foregoing  provisions  caused  Plaintiff  injury.  This 
injury  includes,  but  is  not  limited  to,  injury  resulting  from  harm  to  DNC  computers  and  servers, 
loss  in  the  value  of  DNC  trade  secrets  and  business  information,  and  harm  to  business  as  described 
above.  Plaintiff  is  entitled  to  recover  damages  and  the  costs  of  suit  under  Va.  Code  Ann.  §  18.2- 
152.12. 

PRAYER  FOR  RELIEF 

WHEREFORE,  Plaintiff  demands  judgment  against  Defendants  on  all  Counts,  and  seeks 
such  relief  as  specified  below  for  all  Counts  for  which  such  relief  is  provided  by  law: 

a)  Awarding  Plaintiff  damages  in  an  amount  to  be  determined,  including  but  not  limited  to  all 
damages  and  losses  suffered  by  Plaintiff  as  a  result  of  the  illegal  hacking,  theft,  and 
subsequent  release  of  Plaintiff  s  confidential  documents  and/or  Plaintiffs  response  to  and 
remediation  related  thereto; 

b)  Awarding  Plaintiff  compensatory  and  treble  damages,  as  available,  in  an  amount  to  be 
proven  at  trial; 

c)  Awarding  Plaintiff  the  financial  gain  earned  by  Defendants  as  a  consequence  of  the 
violations  described  herein; 

d)  Awarding  Plaintiff  statutory  damages,  as  available; 

e)  Awarding  Plaintiff  punitive  damages,  as  available; 
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f)  Issuing  a  declaration  that:  Defendants,  according  to  proof,  conspired  to  and  did  engage  in 
a  common  scheme  to  effect  the  illegal  and  unauthorized  hacking  of  Plaintiff  s  computer 
systems  and/or  personal  emails  and  the  exfiltration  of  confidential  information; 
disseminated  that  stolen  information  to  the  public;  and  used  that  disclosed  stolen 
information  to  impact  the  2016  election  for  their  own  gain; 

g)  Issuing  an  injunction  restraining  Defendants  and  their  officers,  agents,  servants, 
employees,  assigns,  and  those  acting  in  active  concert  or  participation  with  them  from: 

a.  Accessing  Plaintiffs  computer  networks  and/or  personal  emails  without  Plaintiffs 
authorizations; 

b.  Engaging  in  any  activity  that  disrupts,  diminishes  the  quality  of,  interferes  with  the 
performance  of,  or  impairs  the  functionality  of  Plaintiffs  computer  networks  or 
personal  emails;  and 

c.  Selling,  publishing,  distributing,  or  using  any  property  or  information  obtained 
from  Plaintiffs  computer  networks  or  personal  emails  without  Plaintiffs 
authorization; 

d.  Removing,  extracting,  or  copying  any  information  or  data  from  Plaintiffs 
computers  or  personal  emails  without  Plaintiffs  authorization; 

h)  Awarding  Plaintiff  all  costs  and  attorneys’  fees  to  the  full  extent  permitted  under  the 
applicable  law; 

i)  Awarding  Plaintiff  pre-  and  post-judgment  interest  as  permitted  by  law; 

j)  Awarding  any  other  relief  as  the  Court  may  deem  just  and  proper. 

JURY  DEMAND 

Pursuant  to  Rule  38  of  the  Federal  Rules  of  Civil  Procedure,  Plaintiff  demands  trial  by  jury 
in  this  action  of  all  issues  so  triable. 
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October  3,  2018 


Respectfully  submitted, 


/ s /  Michael  Eisenkraft _ 

Michael  Eisenkraft 

Cohen  Milstein  Sellers  &  Toll  PLLC 

88  Pine  St.  #  14 

New  York,  NY  10005 

(212) 838-7797 

meisenkraft@cohenmilstein.  com 


Joseph  M.  Sellers 
Geoffrey  A.  Graber 
Julia  A.  Horwitz 
Alison  S.  Deich 
Eric  S.  Berelovich 

Cohen  Milstein  Sellers  &  Toll  PLLC 
1100  New  York  Ave.  NW  •  Fifth  Floor 
Washington,  DC  20005 
(202)  408-4600 

j  sellers@cohenmilstein.  com 
ggraber@cohenmilstein.  com 
jhorwitz@cohenmilstein.com 
adeich@cohenmilstein.com 
eberelovich@cohenmilstein.  com 


Attorneys  for  Plaintiff 
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CERTIFICATE  OF  SERVICE 

I  hereby  certify  that  on  October  3,  2018, 1  electronically  filed  the  Amended  Complaint  with 
the  Clerk  of  the  Court  using  the  ECF,  who  in  turn  sent  notice  to  all  counsel  of  record. 


Dated:  October  3,  2018 

/s/  Michael  Eisenkrcift 

Michael  Eisenkraft 
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